Exploitation observed; activity peaked at 7 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-04 | 3 | Disclosure3 |
| 2026-05-07 | 1 | Active Exploitation1 |
| 2026-05-10 | 4 | Disclosure2General2 |
| 2026-06-04 | 7 | Disclosure7 |
| 2026-06-10 | 2 | General1Patch1 |
| 2026-08-27 | 2 | Disclosure1Exploit1 |
🚨 Critical - Malicious npm package vm2 (CVE-2026-24118) A package contains embedded malicious code that can intercept data and manipulate application behavior. 👉 Remove immediately — treat affected systems as compromised
Post summary
The text alerts that a malicious npm package vm2 (CVE-2026-24118) can intercept data and alter application behavior, urging immediate removal and treating affected systems as compromised.
[EXPLOIT] EGE-GH-Q8rk9MC [CRITICAL/PoC] Linked: CVE-2026-24118 CVE-2026-24118 🔗 https://exploitgrid.net/exploits/e875881a-186c-4291-be48-dfa1b8eda9a5
Post summary
The post shares a critical PoC for CVE‑2026‑24118, linking to exploitgrid where exploit code presumably resides, but offers no patch information or evidence of active exploitation.
🛡️ ExploitGrid Daily Threat Digest Critical Exploits disclosed today: CVE-2026-39440 CVE-2026-24118 CVE-2023-20887 CVE-2023-20887 CVE-2023-20887 ..🧵👇
Post summary
The digest announces several newly disclosed CVEs without providing further technical details or indicators of exploitation.
New advisory to triage: CVE-2026-24118. VM2 Sandbox Breakout Through __lookupGetter__ Inventory first. Panic never helps.
Post summary
The post announces an advisory for CVE‑2026‑24118 involving a VM2 sandbox breakout via __lookupGetter__, but gives no explicit PoC, exploit code, remediation, or evidence of active exploitation.
Status vs CVSS vs Attack Vector: CVE-2026-24118: Patched in 3.11.0 (vs CVSS 9.8 | Attack Vector `__lookupGetter__` + Buffer.apply → host Function.prototype) CVE-2026-43999: Patched in 3.11.0 (vs CVSS 9.9 | Attack Vector NodeVM builtin allowlist bypass (`builtin: ['*',…
Post summary
The brief update reports that CVE‑2026‑24118 and CVE‑2026‑43999 have been patched in version 3.11.0, providing CVSS scores and attack vector details for each vulnerability.
The Sandbox That Never Was: CVE-2026-24118 Turns vm2 Into a Developer Supply Chain Weapon. Six critical vulnerabilities in the Node.js vm2 sandbox library CVE-2026-24118, CVE-2026-22709, CVE-2026-24120, CVE-2026-24781, CVE-2026-26332, CVE-2026-26956 expose full remote…
Post summary
The snippet announces six critical vulnerabilities in the Node.js vm2 sandbox library but offers no proof of exploitation, PoC, or patch details.
What this means for your agents and systems: A critical remote code execution vulnerability (CVE-2026-24118, CVSS 9.8) in the npm library vm2 (versions prior to 3.11.0) allows attackers to completely bypass the JavaScript sandbox isolation and execute arbitrary code on the…
Post summary
The post announces a critical remote code execution vulnerability (CVE-2026-24118) in the npm library vm2, detailing how attackers can bypass sandbox isolation to execute arbitrary code.
The Sandbox Wall Cracked: CVE-2026-24118 Turns vm2 Into an Arbitrary Code Gateway A critical remote code execution vulnerability CVE-2026-24118, CVSS 9.8 in the npm library vm2 versions prior to 3.11.0 allows attackers to completely bypass the JavaScript sandbox isolation…
Post summary
The post announces a critical remote code execution vulnerability (CVE‑2026‑24118) in npm’s vm2 library, detailing its severity (CVSS 9.8) and the ability to bypass sandbox isolation in versions prior to 3.11.0, but it does not provide a PoC link, exploit code, or evidence of active exploitation.
Six critical vulnerabilities in the Node.js vm2 sandbox library (CVE-2026-24118, CVE-2026-22709, CVE-2026-24120, CVE-2026-24781, CVE-2026-26332, CVE-2026-26956) expose full remote code execution on any system running untrusted code in vm2. CVSS 10.0. Disclosed May 3, 2026.…
Post summary
Six critical RCE vulnerabilities in the Node.js vm2 library have been announced with a CVSS score of 10.0. No PoC, exploit code, or mitigation details are provided.
3 million · CVE-2026-24118 · < 3.11.0 → 9.8 The Sandbox Wall Cracked: CVE-2026-24118 Turns vm2 Into an Arbitrary Code Gateway
Post summary
CVE-2026-24118 allows arbitrary code execution via vm2 for versions < 3.11.0, with a high CVSS score of 9.8, but no PoC, exploit code, or patch details are provided.
A critical remote code execution vulnerability (CVE-2026-24118, CVSS 9.8) in the npm library vm2 (versions prior to 3.11.0) allows attackers to completely bypass the JavaScript sandbox isolation and execute arbitrary code on the host system. The flaw defeats the entire…
Post summary
The announcement highlights a critical remote code execution flaw in npm’s vm2 library that allows bypassing the JavaScript sandbox and executing arbitrary code on the host system.
CVE-2026-24118 is the primary RCE vector, stemming from insufficient sanitization of cross-realm object interactions within the V8 engine. The remaining five CVEs target alternative escape chains through similar mechanisms.
Post summary
The text announces CVE-2026-24118 as the main RCE vector in V8 due to cross‑realm sanitization issues, noting five more CVEs that use similar escape chains.
CRITICAL: CVE-2026-24118 (CVSS 9.8) — multiple products. CVE: CVE-2026-24118 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The text announces the discovery of CVE‑2026‑24118, providing its severity rating and CVSS vector without mentioning any PoC, exploit code, active attacks, patches, or false‑positive discussion.
https://lyrie.ai/research/research/cve-2026-24118-advisory #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
An advisory link for CVE-2026-24118 is posted, but the text lacks any substantive details about the vulnerability.
References CVE: CVE-2026-24118 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The text is a brief advisory noting the critical CVE‑2026‑24118, providing its CVSS score and severity, but lacking details on exploitation, PoC, or mitigation.
CVE: CVE-2026-24118 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory vm2 is an open source vm/sandbox for Node.js.
Post summary
Critical vulnerability (CVE-2026-24118) disclosed for the open source vm2 Node.js sandbox, with CVSS 9.8, but no exploit, patch, or false‑positive information is provided.
TRC analysis shows attackers exploited vm2 sandbox escape vulnerabilities (CVE-2026-22709, CVE-2026-24118) to execute arbitrary code and escalate privileges. Post-compromise lateral movement highlights how runtime segmentation can limit blast radius in containerized environments. #DevSecOps #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/vm2-nodejs-library-vulnerabilities-2026
Post summary
The text reports that attackers have actively exploited CVE‑2026‑22709 and CVE‑2026‑24118 for arbitrary code execution and privilege escalation, as detailed in the TRC analysis.
🚨*CVE* CVE-2026-24118 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which ca… https://www.cve.org/CVERecord?id=CVE-2026-24118 ----- Traducción: CVE-2026-24118 vm2… http://infoflow.cloud`
Post summary
CVE‑2026‑24118 impacts vm2 versions older than 3.11.0, enabling sandbox breakout for arbitrary code execution. No PoC, exploit, patch, or active exploitation is reported.
CVE-2026-24118 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which ca… https://www.cve.org/CVERecord?id=CVE-2026-24118
Post summary
CVE-2026-24118 exposes a sandbox breakout in the Node.js vm2 package before version 3.11.0, enabling attackers to write malicious code, but no PoC, exploit details, or patch information are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vm2_project | vm2 | - | node.js | - |