CVE-2026-24118

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-693 CWE-749

Affected software

Vendor	Product	Versions
patriksimek	vm2	< 3.11.0
Red Hat	Red Hat Developer Hub	—
Red Hat	Self-service automation portal 2	—

References

Timeline

Published: May 4, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-24126.5The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up CVE-2026-241209.8vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented al CVE-2026-241223.7Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validi CVE-2026-241236.5BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML'CVE-2026-241249.8Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoin CVE-2026-241256.3Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using rel CVE-2026-241269.1Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH CVE-2026-241276.1Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists CVE-2026-241286.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16 CVE-2026-241298.8Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above CVE-2026-24137.5The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and inc CVE-2026-241305.3Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured wit