CVE-2026-26332
Published: 04 May 2026
Summary
CVE-2026-26332 is a critical-severity Code Injection (CWE-94) vulnerability in Vm2 Project Vm2. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-26332 is a critical vulnerability in vm2, an open source virtual machine and sandbox implementation for Node.js. Prior to version 3.11.0, the SuppressedError mechanism allows attackers to escape the sandbox confines and execute arbitrary code on the host system. The issue is associated with CWE-94 (code injection) and CWE-693 (protection mechanism failure), earning a CVSS v3.1 base score of 9.8.
The vulnerability enables remote exploitation over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N), no user interaction (UI:N), and resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) under an unchanged scope (S:U). Any unauthenticated attacker able to trigger vm2 sandbox execution, such as through untrusted input in Node.js applications using the library for code isolation, can break out and run arbitrary code with the privileges of the hosting process.
The vulnerability has been patched in vm2 version 3.11.0. Security advisories and release notes on GitHub, including GHSA-55hx-c926-fr95 and the v3.11.0 release tag, detail the fix and recommend upgrading immediately to mitigate the sandbox escape risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26993
Vulnerability details
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote unauthenticated arbitrary code execution via sandbox escape in a Node.js library (CWE-94), directly mapping to exploitation of exposed applications and JavaScript command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates timely remediation of identified flaws, directly addressing CVE-2026-26332 by requiring patching of vm2 to version 3.11.0.
RA-5 requires vulnerability scanning of system components and dependencies, enabling early detection and remediation of the vm2 sandbox escape vulnerability.
SC-50 enforces robust software-based separation and policy mechanisms, mitigating sandbox escape risks like SuppressedError in vm2 by requiring verified isolation.