CVE-2026-24120
Published: 04 May 2026
Summary
CVE-2026-24120 is a critical-severity Code Injection (CWE-94) vulnerability in Vm2 Project Vm2. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 44.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-24120 affects vm2, an open-source virtual machine and sandbox for Node.js applications. In versions prior to 3.10.5, the patch for the prior vulnerability CVE-2023-37466 proves insufficient and can be bypassed. This allows attackers to craft code that escapes the VM2 sandbox confines, enabling execution of arbitrary commands directly on the host system. The issue is classified under CWE-94 (code injection) and CWE-693 (protection mechanism failure), with a CVSS v3.1 base score of 9.8.
Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, specifically by breaking out of the sandbox to run arbitrary host commands, potentially leading to full system compromise in environments relying on vm2 for code isolation.
The vm2 project has addressed this in version 3.10.5, as detailed in the release notes and GitHub security advisory GHSA-qvjj-29qf-hp7p. Security practitioners should prioritize upgrading affected Node.js applications using vm2 to at least version 3.10.5 to mitigate the sandbox escape risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26986
Vulnerability details
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the…
more
host system. This issue has been patched in version 3.10.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Sandbox escape in vm2 directly enables remote arbitrary command execution on the host (T1059), via exploitation of a public-facing sandboxed application (T1190) and serves as a privilege escalation vector by breaking isolation boundaries (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, testing, and deployment of patches for vm2 to version 3.10.5, directly eliminating the sandbox escape vulnerability.
Mandates vulnerability scanning to identify CVE-2026-24120 in vm2 deployments and subsequent risk-based remediation, preventing exploitation.
Enforces deny-all-permit-by-exception policy to block execution of vulnerable vm2 versions, mitigating sandbox escape risk.