PT-2026-36848

CVE-2026-24781

Published

2026-05-04

Updated

2026-10-08

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0

Description vm2 is an open source sandbox for Node.js. A sandbox breakout occurs through the inspect() function, allowing attackers to write code that escapes the sandbox environment and executes arbitrary commands on the host system.

Recommendations Update to version 3.11.0. As a temporary workaround, consider restricting the use of the inspect() function until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-653: Improper Isolation or Compartmentalization

CWE-693: Protection Mechanism Failure

Related identifiers