CVE-2026-26956

Deeper analysis

CVE-2026-26956 affects vm2, an open source virtual machine and sandbox for Node.js, specifically in version 3.10.4. The vulnerability enables a full sandbox escape, allowing arbitrary code execution on the host system. An attacker running malicious code within VM.run() can obtain a reference to the host process object and execute host commands without any cooperation from the host environment. The issue is rated critical with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-693 (Protection Mechanism Failure).

Any remote attacker with the ability to supply code executed via VM.run() can exploit this vulnerability without privileges, user interaction, or special conditions. Successful exploitation grants full access to the host process, enabling arbitrary command execution with the privileges of the Node.js process running vm2. This bypasses the intended sandbox isolation, potentially leading to complete host compromise, including data theft, persistence, or further lateral movement.

The vulnerability has been patched in vm2 version 3.10.5, as detailed in the project's release notes and security advisory. Security practitioners should immediately upgrade to version 3.10.5 or later and review deployments using vm2 3.10.4 for potential exposure. Relevant resources include the GitHub release at https://github.com/patriksimek/vm2/releases/tag/v3.10.5 and the security advisory at https://github.com/patriksimek/vm2/security/advisories/GHSA-ffh4-j6h5-pg66.