Arbitrary Code Execution Vulnerability in vm2 by Patrik Simek

CVE-2026-26956

What is CVE-2026-26956?

The vm2 library, utilized for creating secure Node.js environments through sandboxing, was found to be vulnerable in version 3.10.4. This flaw allows attackers to execute arbitrary code outside the intended security boundaries, effectively achieving a full sandbox escape. With the use of the VM.run() method, malicious actors can access the host process object and execute host commands without any user interactions. This significant security issue exposes Node.js applications to potential exploitation, making it crucial for developers to update to the patched version 3.10.5 to mitigate these risks.

References