Vulnerability intelligence

CVE-2026-26332

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.

CVSS Score

9.8

Critical

EPSS — Exploit Probability

0.7%

Riskier than 51% of all CVEs · checked 2026-09-09

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

1 article across 1 outlet · first covered May 7, 2026 · latest May 7, 2026

Coverage timeline

Critical vm2 Node.js flaws expose systems to sandbox escapes
thehackernews.com · May 7, 2026

Related CVEs — patriksimek

CVE-2026-47686 CVE-2026-47698 CVE-2026-26956 CVE-2026-24118 CVE-2026-24120 CVE-2026-24781 CVE-2026-43997