PT-2026-36851 · Npm · Vm2

Patriksimek · CVE-2026-26332 · Published 2026-05-01 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0

Description vm2 is an open source vm/sandbox for Node.js. The use of SuppressedError allows attackers to escape the sandbox and execute arbitrary code.

Recommendations Update to version 3.11.0.

Exploit

Fix

Code Injection

Protection Mechanism Failure

Weakness Enumeration

CWE-94

CWE-653

CWE-693

Related Identifiers

BDU:2026-06427

CVE-2026-26332

GHSA-55HX-C926-FR95

Affected Products

Vm2

References · 25

• 🔥 https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26332.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-26332 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-55hx-c926-fr95 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26332 · Security Note
• https://bdu.fstec.ru/vul/2026-06427 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-26332 · Vendor Advisory
• https://github.com/patriksimek/vm2/releases/tag/v3.11.0 · Note
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/commit/792e16d56ee429ab19e284ed9c545f5e4694fb7d · Note
• https://github.com/patriksimek/vm2/commit/7395c3a4b01d302e55271c87dbeb44d6b83b81ca · Note
• https://github.com/patriksimek/vm2/commit/4cb82cc94d9bb6c9a918b45f8c6790c32a5e913f · Note
• https://github.com/patriksimek/vm2/commit/119fd0aa1e4c27b08cf37946b2dafa99e2c754f0 · Note
• https://github.com/patriksimek/vm2/commit/d715dd88c5aec5bbb4dce03ddf7c3eb3791d0338 · Note
• https://twitter.com/CVEnew/status/2051361292057821427 · Twitter Post