by Kastro
Paper/Archive/CVE-2026-26956

CVE-2026-26956

patriksimek vm2 — vm2: WASM Sandbox Escape (Node 25 only)

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
53
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 65.3.653 × 2013.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation. This issue has been patched in version 3.10.5.

Affected

ProductAffectedFixed inSource
vm2= 3.10.4–CNA
Red Hat Developer Hubsee advisory–redhat-SADP
Red Hat Developer Hubsee advisory–redhat-SADP
Self-service automation portal 2see advisory–redhat-SADP

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat-SADP (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/patriksimek/vm2/security/advisories/GHSA-ffh4-j6h5-pg66refgithub.com/patriksimek/vm2/releases/tag/v3.10.5refaccess.redhat.com/security/cve/CVE-2026-26956refbugzilla.redhat.com/show_bug.cgi?id=2466548refsecurity.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26956.json