{"id":"CVE-2026-26332","state":"PUBLISHED","title":"vm2: Sandbox Escape","description":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.","publishedAt":"2026-05-04T16:35:52.706Z","updatedAt":"2026-07-15T01:14:58.971Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["patriksimek vm2"],"affected":[{"vendor":"patriksimek","product":"vm2","versions":[{"version":"< 3.11.0","status":"affected"}]}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95","https://github.com/patriksimek/vm2/releases/tag/v3.11.0","https://access.redhat.com/security/cve/CVE-2026-26332","https://bugzilla.redhat.com/show_bug.cgi?id=2466508","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26332.json"],"weaknesses":["CWE-94","CWE-693","CWE-653"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/26xxx/CVE-2026-26332.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-26332","state":"PUBLISHED","datePublished":"2026-05-04T16:35:52.706Z","dateUpdated":"2026-07-15T01:14:58.971Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-02-13T16:27:51.810Z"},"containers":{"cna":{"title":"vm2: Sandbox Escape","descriptions":[{"lang":"en","value":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0."}],"affected":[{"vendor":"patriksimek","product":"vm2","versions":[{"version":"< 3.11.0","status":"affected"}]}],"references":[{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95","name":"https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.0","name":"https://github.com/patriksimek/vm2/releases/tag/v3.11.0","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","lang":"en","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-693","lang":"en","description":"CWE-693: Protection Mechanism Failure","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-05-04T16:35:52.706Z"},"source":{"advisory":"GHSA-55hx-c926-fr95","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-04T19:06:32.471517Z","id":"CVE-2026-26332","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-04T19:06:53.442Z"}},{"title":"vm2: vm2: Arbitrary code execution via SuppressedError sandbox escape","descriptions":[{"lang":"en","value":"A flaw was found in vm2, an open-source sandbox for Node.js. This vulnerability allows a remote attacker to escape the sandbox environment by exploiting the `SuppressedError` mechanism. Successful exploitation can lead to arbitrary code execution on the host system, compromising the integrity and confidentiality of the affected system."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Developer Hub","packageName":"rhdh/rhdh-hub-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhdh:1"]},{"vendor":"Red Hat","product":"Self-service automation portal 2","packageName":"ansible-automation-platform/automation-portal","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_portal:2"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-26332","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466508","name":"RHBZ#2466508","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26332.json","tags":["x_sadp-csaf-vex"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-653","description":"Improper Isolation or Compartmentalization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T01:14:58.971Z"},"datePublic":"2026-05-04T16:35:52.706Z","timeline":[{"lang":"en","time":"2026-05-04T19:02:30.129Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-05-04T16:35:52.706Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}