PT-2026-36847 · Npm · Vm2

Xmiliah · Published 2026-05-01 · Updated 2026-05-11 · CVE-2026-24120

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.10.5

Description An insufficient fix in the sandbox implementation allows attackers to bypass security restrictions, enabling them to escape the VM2 sandbox and execute arbitrary commands on the host system. This is possible because the resetPromiseSpecies() function, which is intended to reset the species property of promise objects, relies on [].includes and Object.defineProperty. These functions can be overwritten to prevent the property from being changed, leading to remote code execution if an attacker can run arbitrary code within the sandbox context.

Recommendations Update to version 3.10.5.

Exploit

Fix

Protection Mechanism Failure

Code Injection

Weakness Enumeration

CWE-693

CWE-94

Related Identifiers

BDU:2026-06464

CVE-2026-24120

GHSA-QVJJ-29QF-HP7P

Affected Products

Vm2

References · 13

• 🔥 https://github.com/patriksimek/vm2/security/advisories/GHSA-qvjj-29qf-hp7p · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-24120 · Security Note
• https://bdu.fstec.ru/vul/2026-06464 · Security Note
• https://osv.dev/vulnerability/GHSA-qvjj-29qf-hp7p · Vendor Advisory
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5 · Note
• https://github.com/patriksimek/vm2/releases/tag/v3.10.5 · Note
• https://twitter.com/lyrie_ai/status/2053409240174186724 · Twitter Post
• https://t.me/cveNotify/162541 · Telegram Post
• https://twitter.com/so_sthbryan/status/2053910007159337110 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051362910597685378 · Twitter Post
• https://twitter.com/CVEnew/status/2051361294456901951 · Twitter Post
• https://t.me/cveNotify/162777 · Telegram Post