Vulnerability intelligence
CVE-2026-26332
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
CVSS Score
9.8
Critical
EPSS — Exploit Probability
0.7%
Riskier than 49% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
Patch available
Vendor fix published
1 article across 1 outlet · first covered May 7, 2026 · latest May 7, 2026
Coverage timeline
-
Critical vm2 Node.js flaws expose systems to sandbox escapesthehackernews.com · May 7, 2026