Vulnerabilitycritical

vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution

The Hacker Newsby @TheHackersNewsMay 11, 2026 · 03:55 UTC (May 11, 2026)3 min read3 · 2 reads

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-24118 CVE-2026-24120 CVE-2023-37466 CVE-2026-24781 CVE-2026-26332 CVE-2026-26956 CVE-2026-43997 CVE-2026-43999 CVE-2026-44005 CVE-2026-44006 CVE-2026-44007 CVE-2026-44008 CVE-2026-44009 CVE-2026-22709

Tags: cve-2023-37466 cve-2026-24118 cve-2026-24120 cve-2026-24781 cve-2026-26332 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-37466	vm2 is an advanced vm/sandbox for Node.js	10.0	4%	PoC	Jul 14, 2023
CVE-2026-22709	vm2 is an open source vm/sandbox for Node.js	10.0	1%	PoC	Jan 26, 2026
CVE-2026-26332 +4 related CVEs CVE-2026-24781 CVE-2026-26956 CVE-2026-24118 CVE-2026-24120	vm2 is an open source vm/sandbox for Node.js	10.0 group max	<1%	PoC	May 4, 2026
CVE-2026-43997 +6 related CVEs CVE-2026-44005 CVE-2026-44006 CVE-2026-43999 CVE-2026-44008 CVE-2026-44009 CVE-2026-44007	vm2 is an open source vm/sandbox for Node.js	10.0 group max	<1%	PoC	May 13, 2026

From the original article

3 min read at thehackernews.com

 Ravie Lakshmanan  May 07, 2026 Vulnerability / Software Security A dozen critical security vulnerabilities have been disclosed in the vm2 Node. js library that could be exploited by bad actors to break out of the sandbox and execute arbitrary code on susceptible systems.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.