CVE-2026-26332
vm2 is an open source vm/sandbox for Node.js.
Published May 4, 2026 · updated Jul 15, 2026 · vm2 project vm2
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 4, 2026 · NIST NVD
Detected
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
Jul 15, 2026 · NIST NVD
Updated
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
Affected
- cpe vm2 project/vm2version unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-26332
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-26332
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
nvd.nist.gov