CVE-2026-26956

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-26956

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26956.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-26956

Aliases

GHSA-ffh4-j6h5-pg66

Downstream

ROOT-APP-NPM-CVE-2026-26956

Published

2026-05-04T16:37:31.538Z

Modified

2026-07-16T03:30:58.870257890Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

vm2: WASM Sandbox Escape (Node 25 only)

Details

vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation. This issue has been patched in version 3.10.5.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-693"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26956.json"
}

References

Affected packages

Git / github.com/patriksimek/vm2

Affected ranges

Type

GIT

Repo

https://github.com/patriksimek/vm2

Events

Introduced

7cf744506cd2ab3544103eb5a4e64408eaec4a87

Fixed

408fc855f1cc1bbc2985b029465ee0e732ada433

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "= 3.10.4"
        },
        {
            "last_affected": "= 3.10.4"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "3.10.5"
        }
    ]
}

Affected versions

= 3.*

= 3.10.4

v3.*

v3.10.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26956.json"