vm2 Sandbox Escape (CVE-2026-26332) Exposes Node.js Apps to RCE
A critical vulnerability, CVE-2026-26332, has been identified in vm2, an open-source sandbox for Node.js. The National Vulnerability Database reports that prior to version 3.11.0, the SuppressedError mechanism allows attackers to escape the vm2 sandbox and execute arbitrary code on the host system. This is a direct sandbox escape, rated with a CVSS score of 9.8 (Critical), indicating severe impact on confidentiality, integrity, and availability.
This flaw, categorized under CWE-94 (Improper Control of Generation of Code (‘Code Injection’)) and CWE-693 (Protection Mechanism Failure), means that any application relying on vm2 for secure code execution is at extreme risk. The attacker’s calculus here is simple: if they can get code into your vm2 sandbox, they own the underlying system. This isn’t just about data exfiltration; it’s about full system compromise, persistent access, and lateral movement.
Defenders must prioritize patching. The fix is available in vm2 version 3.11.0. Any unpatched Node.js environments using vm2 for isolation, especially those processing untrusted code or user input, are open season for attackers. This isn’t a theoretical risk; it’s a critical remote code execution vector that bypasses a fundamental security control.
What This Means For You
- If your Node.js applications use vm2 for sandboxing, you need to immediately verify your version. Patch to vm2 version 3.11.0 or higher right now. Audit any code that executes within vm2 for potential exploit attempts if you were running an affected version.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
vm2 Sandbox Escape via SuppressedError - CVE-2026-26332
title: vm2 Sandbox Escape via SuppressedError - CVE-2026-26332
id: scw-2026-05-04-ai-1
status: experimental
level: critical
description: |
Detects the use of the vm2 library in Node.js applications with patterns indicative of an attempt to exploit CVE-2026-26332. The exploit leverages the SuppressedError class to escape the sandbox and execute arbitrary code. This rule looks for 'node.exe' processes that involve 'vm2' and common JavaScript execution patterns like 'eval', 'constructor', 'Function', 'prototype', 'apply', and 'call' within the command line, which are often used in sandbox escape attempts.
author: SCW Feed Engine (AI-generated)
date: 2026-05-04
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-26332/
tags:
- attack.execution
- attack.t1059.003
logsource:
category: process_creation
detection:
selection:
Image|contains:
- 'node.exe'
CommandLine|contains:
- 'vm2'
- 'eval'
- 'constructor'
- 'Function'
- 'prototype'
- 'apply'
- 'call'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-26332 | RCE | vm2 sandbox escape via SuppressedError |
| CVE-2026-26332 | RCE | vm2 Node.js library versions prior to 3.11.0 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 04, 2026 at 20:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
Prometheus CVE-2026-42154: Unauthenticated Memory Exhaustion Vulnerability
CVE-2026-42154 — Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not...
Prometheus Azure AD OAuth Secret Exposed via Plaintext Config
CVE-2026-42151 — Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD...
CVE-2026-25863: WordPress Plugin DoS Vulnerability Hits Contact Form 7
CVE-2026-25863 — Conditional Fields for Contact Form 7 WordPress plugin through version 2.6.7 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailParser class where the...