Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.10.5.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-04 | 2 | General2 |
| 2026-05-05 | 1 | Disclosure1 |
| 2026-05-06 | 1 | Disclosure1 |
| 2026-05-10 | 2 | General2 |
| 2026-05-11 | 1 | Patch1 |
| 2026-06-04 | 2 | Disclosure1General1 |
| 2026-08-27 | 1 | PoC1 |
Node.jsのvm2サンドボックスライブラリに複数の重大(Critical)な脆弱性。CVE-2026-26956、CVE-2026-24120、CVE-2026-24781、CVE-2026-24118の4件で、いずれもCVSSスコア9.8。修正版提供あり。 https://securityonline.info/vm2-sandbox-escape-9-8-cvss-rce-vulnerabilities-node-js/
Post summary
Four critical CVEs affecting Node.js's vm2 sandbox were announced, all scoring 9.8, with a patch now available to mitigate the flaw.
CVE-2026-24120: Yet Another Sandbox Escape in vm2, or a Fundamental Design Problem? An analysis of CVE-2026-24120 in vm2, a sandbox for running JavaScript inside Node.js, has been published. Exploitation allows an attacker to escape the sandbox and execute commands on the host. Versions through 3.10.3 are affected, with the issue patched in 3.10.5. The CVE record the issue as an insufficient fix for CVE-2023-37466, which is related to Promise "Symbol.species". However, the author found that "resetPromiseSpecies", the mechanism responsible for this protection, remained unchanged in version 3.10.5. Instead, the developers strengthened exception handling by replacing "ensureThis()" with "handleException()". A separate patch also blocked "WebAssembly.JSTag", which provided another path for leaking a host-realm exception into sandbox code. The key operation in the PoC is "http://e.name = Symbol()". When "e.stack" is accessed, V8 attempts to convert "name" to a string, causing a "TypeError" in the host realm. Inside an async function, this causes the Promise to be rejected with a host-realm error. Once that object reaches sandbox code, the attacker can use "constructor.constructor" to reach the host "Function", access "process", and execute commands. The author traced five fixes for the same sandbox escape mechanism over 32 months: through different paths, host-realm objects repeatedly became accessible to code inside the sandbox. Just four releases — 3.10.5, 3.11.0, 3.11.1, and 3.11.2 — collectively addressed 18 security advisories. Moreover, one of the subsequent vulnerabilities was introduced by a hardening mechanism added in response to an earlier advisory. The vm2 README itself warns about the fundamental difficulty of building a reliable in-process JavaScript sandbox. The architecture of such a sandbox leaves a broad attack surface for new escape techniques to emerge. PoC: https://github.com/patriksimek/vm2/security/advisories/GHSA-qvjj-29qf-hp7p Article: https://nefariousplan.com/posts/vm2-cve-2026-24120-readme-already-admits #dbugs_attacks
Post summary
The article dissects CVE‑2026‑24120, detailing a sandbox escape in vm2 that enables command execution, provides a PoC and discusses patches up to version 3.10.5.
🚨 Critical - Node.js vm2 Sandbox Escape (CVE-2026-24120, CVE-2026-24781, CVE-2026-26332, CVE-2026-26956) A series of critical vulnerabilities in the vm2 library allows unauthenticated attackers to bypass the sandbox environment. By exploiting flaws in object sanitization and error handling (such as SuppressedError), an attacker can "break out" of the virtual machine and execute arbitrary commands directly on the host operating system. 👉 Affected: vm2 < 3.11.0, <3.10.5 | Upgrade to 3.11.0, 3.10.5
Post summary
The post announces critical Node.js vm2 sandbox escape vulnerabilities, details the technical flaw, and recommends upgrading to patched versions.
The Sandbox That Never Was: CVE-2026-24118 Turns vm2 Into a Developer Supply Chain Weapon. Six critical vulnerabilities in the Node.js vm2 sandbox library CVE-2026-24118, CVE-2026-22709, CVE-2026-24120, CVE-2026-24781, CVE-2026-26332, CVE-2026-26956 expose full remote…
Post summary
The text announces six critical issues in the Node.js vm2 sandbox library but does not supply technical specifics, exploitation details, or mitigation steps.
Six critical vulnerabilities in the Node.js vm2 sandbox library (CVE-2026-24118, CVE-2026-22709, CVE-2026-24120, CVE-2026-24781, CVE-2026-26332, CVE-2026-26956) expose full remote code execution on any system running untrusted code in vm2. CVSS 10.0. Disclosed May 3, 2026.…
Post summary
The announcement reveals six critical CVEs in Node.js vm2 that allow full remote code execution, each with a CVSS score of 10.0, but no patches or PoC details are provided.
Unpopular opinion: The cybersecurity industry is selling you dashboards. CVE: CVE-2026-24120 CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The tweet announces the discovery of CVE‑2026‑24120, a critical vulnerability with a high CVSS score, but offers no additional technical, exploit, or mitigation details.
CVE-2026-24120 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write … https://www.cve.org/CVERecord?id=CVE-2026-24120
Post summary
The post briefly references CVE‑2026‑24120, noting that a previous fix is inadequate and can be bypassed for write access, but provides no PoC, exploit, or patch details.
Your Node.js sandbox is broken. Patch before your AI agent runs user code. vm2 CVE-2026-24120 (CVSS 9.8): bypass of CVE-2023-37466 lets attackers escape the VM and run host commands. Update to 3.11.2. Your agent's sandbox has a known exploit. https://www.cve.org/CVERecord?id=CVE-2026-24120
Post summary
Node.js sandbox vulnerability CVE-2026-24120 (CVSS 9.8) allows escape of the VM and execution of host commands; the recommended fix is to upgrade to version 3.11.2.
https://lyrie.ai/research/research/cve-2026-24120-advisory #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The message provides only a link and hashtags with no explicit details about the CVE.
🚨*CVE* CVE-2026-24120 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write … https://www.cve.org/CVERecord?id=CVE-2026-24120 ----- Traducción: CVE-2026-24120 vm2… http://infoflow.cloud`
Post summary
The tweet alerts to CVE-2026-24120 aboard vm2, noting the earlier fix for CVE-2023-37466 is insufficient, but offers no PoC, exploit, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vm2_project | vm2 | - | node.js | - |