CVE-2026-24781Critical· 9.8▾ Midnightvm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can escape from the VM2 sandbox and execute …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.2%
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.
vm2 < 3.11.0Upgrade past the affected range:
vm2 3.11.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93603Critical· 10.0vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code calls a host-provided non-strict (sloppy-mode) function without a receiver — e.…
CVE-2026-93606Critical· 10.0vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`
CVE-2026-92937Critical· 10.0vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process
CVE-2026-44005Critical· 10.0vm2 is an open source vm/sandbox for Node.js
CVE-2026-43997Critical· 10.0vm2 is an open source vm/sandbox for Node.js
GHSA-9hxx-m5g2-2q3hCritical· 10.0Duplicate Advisory: vm2 contains a sandbox escape vulnerability