CVE-2026-26956

CVSS 3.1: 9.8 critical
EPSS: 1%p65
Published: May 4, 2026 · May 4, 2026
Modified: Oct 26, 2026

Analyze CVE-2026-26956 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation. This issue has been patched in version 3.10.5.

Vendors: vm2 project

Products: vm2

Weakness: CWE-693, CWE-653

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news

1 story

vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution

The Hacker NewsMay 11, 03:55 UTC · May 11, 2026VulnerabilityCVE-2026-24118 CVE-2026-24120 CVE-2023-37466+113 · 2 reads