CERT24Critical vm2 sandbox flaw lets attackers execute code on the host systemLoading data…
CERT24Threat Observatory
Period

Critical vm2 sandbox flaw lets attackers execute code on the host system

A critical vulnerability in the Node.js vm2 sandboxing library allows attackers to escape the sandbox and execute arbitrary code on the host system. Tracked as CVE-2026-26956, the issue is confirmed to affect vm2 version 3.10.4, and proof-of-concept (PoC) exploit code has been published.

← Back to intelligence

Critical vm2 sandbox flaw lets attackers execute code on the host system

A critical vulnerability in the Node.js vm2 sandboxing library allows attackers to escape the sandbox and execute arbitrary code on the host system. Tracked as CVE-2026-26956, the issue is confirmed to affect vm2 version 3.10.4, and proof-of-concept (PoC) exploit code has been published.