Sandbox Breakout Vulnerability in vm2 for Node.js by Patrik Simek

CVE-2026-24781

What is CVE-2026-24781?

The vm2 library, an open-source sandboxing tool for Node.js, is susceptible to a critical vulnerability prior to version 3.11.0 that enables attackers to exploit the inspect function. By crafting malicious inputs, an attacker could bypass the sandbox restrictions, allowing unauthorized code execution on the host system. This vulnerability has been documented and successfully patched in version 3.11.0, and users are strongly encouraged to upgrade to this version or later to mitigate potential security risks.

References