CVE-2026-24781

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94CWE-693CWE-653

Affected software

VendorProductVersions
patriksimekvm2< 3.11.0
Red HatRed Hat Developer Hub 1.10—
Red HatRed Hat Developer Hub 1.9—
Red HatRed Hat Developer Hub—

References

Timeline

Published
May 4, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-247828.8Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms couldCVE-2026-247837.5soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mulDiv(x, y, z)` functiCVE-2026-247844.8DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and CVE-2026-247859.1Clatter is a no_std compatible, pure Rust implementation of the Noise protocol framework with post-quantum support. Versiosn prior to2.2.0 hCVE-2026-247888.7RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be exeCVE-2026-247899.8An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.CVE-2026-24795.0The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.CVE-2026-247908.2The underlying PLC of the device can be remotely influenced, without proper safeguards or authentication.CVE-2026-247918.1Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routesCVE-2026-247928.1in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps.CVE-2026-247939.8Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (CVE-2026-247949.2Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in CardboardPowered cardboard (src/main/java/org/cardb