Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Vm2 Node.js sandbox escape and RCE vulnerabilities (CVE-2026-24118)

Vulnerability
First reported
Last updated
Happening score
H score 39
1 unique sources, 1 articles

Summary

Hide ▲

vm2 now has multiple critical vulnerabilities that can let attacker-controlled JavaScript escape the sandbox and reach the host, creating arbitrary code execution risk for affected deployments. The disclosure covers flaws such as CVE-2026-24118 and related bypasses, and the recommended fix is to move to 3.11.2.

Related Happenings

CISA KEV mitigation for LiteSpeed cPanel Plugin (CVE-2026-54420)

Advisory/Mitigation
H score38 First: 16.06.2026 08:41 Last: 16.06.2026 08:41 Sources 1

About this happening: CISA put CVE-2026-54420 in LiteSpeed cPanel Plugin on the KEV catalog, ordering FCEB agencies to apply fixes by June 18, 2026. The flaw is a CVSS 8.5 privile...

Open Happening

Vm2 Node.js sandbox escape (CVE-2026-26956)

Vulnerability
H score29 First: 06.05.2026 21:38 Last: 06.05.2026 21:38 Sources 1

About this happening: A PoC exploit for CVE-2026-26956 now exposes vm2 3.10.4 deployments to arbitrary code execution on the host. The flaw may also affect earlier vm2 releases, but...

Open Happening

Terrarium CVE-2026-5752 mitigation guidance

Advisory/Mitigation
H score39 First: 22.04.2026 10:16 Last: 22.04.2026 10:16 Sources 1

About this happening: CERT/CC issued mitigation guidance for Terrarium deployments exposed to CVE-2026-5752, a sandbox-escape flaw that can lead to root code execution. The advice i...

Open Happening

Vm2 Node.js sandbox library sandbox escape (CVE-2026-22709)

Vulnerability
H score78 First: 27.01.2026 18:35 Last: 27.01.2026 18:35 Sources 1

About this happening: vm2 Node.js sandbox library has a critical CVE-2026-22709 sandbox-escape flaw that can let untrusted JavaScript break out and run arbitrary code on the host. The weakn...

Open Happening

Tokio-tar remediation guidance (CVE-2025-62518)

Advisory/Mitigation
H score35 First: 22.10.2025 20:21 Last: 22.10.2025 20:21 Sources 1

About this happening: Edera told developers using tokio-tar to upgrade to a patched version or immediately remove the dependency because CVE-2025-62518 leaves projects exposed to ar...

Open Happening

Timeline

  1. 07.05.2026 07:15 2 articles · 2mo ago

    vm2 vulnerability disclosure

    Initial Disclosure

    Disclosure for the vm2 Node.js library identifies 12 critical vulnerabilities affecting versions through 3.11.1, including sandbox escape paths through __lookupGetter__, inspect, SuppressedError, NodeVM allowlist bypasses, BaseHandler.getPrototypeOf, neutralizeArraySpeciesBatch(), null proto exceptions, and prototype pollution; the reported impact is arbitrary code execution or remote code execution on the underlying host, and operators are advised to upgrade to 3.11.2.

    Show sources
    Open in new tab