CVE-2026-24781
Full vulnerability record from the local CVENow database.
Description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.
Severity
CRITICAL
CVSS score
9.8
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-05-04 17:16:21.960000
Last modified
2026-10-26 19:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-24781",
"sourceIdentifier": "[email protected]",
"published": "2026-05-04T17:16:21.960",
"lastModified": "2026-10-26T19:10:00.163",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0."
},
{
"lang": "es",
"value": "vm2 es una vm/sandbox de código abierto para Node.js. Antes de la versión 3.11.0, VM2 sufre de una vulnerabilidad de escape de sandbox a través de la función inspect. Esto permite a los atacantes escribir código que puede escapar de la sandbox de VM2 y ejecutar comandos arbitrarios en el sistema anfitrión. Este problema ha sido parcheado en la versión 3.11.0."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "patriksimek",
"product": "vm2",
"versions": [
{
"version": "< 3.11.0",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Developer Hub 1.10",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhdh/rhdh-hub-rhel9",
"cpes": [
"cpe:/a:redhat:rhdh:1.10::el9"
],
"versions": [
{
"version": "1783448184",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Developer Hub 1.9",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhdh/rhdh-hub-rhel9",
"cpes": [
"cpe:/a:redhat:rhdh:1.9::el9"
],
"versions": [
{
"version": "1781187342",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Developer Hub",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor",
"cpes": [
"cpe:/a:redhat:rhdh:1"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-04T17:13:58.015290Z",
"id": "CVE-2026-24781",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-94"
},
{
"lang": "en",
"value": "CWE-693"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-653"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "3.11.0",
"matchCriteriaId": "6DD48308-6219-4C66-9BE7-246EE56FB834"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/patriksimek/vm2/commit/8d30d93213c1898b3e035298b89a814970dd1189",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/patriksimek/vm2/commit/bdd3d15e57bc4ec5e70365cd79f7cb0256e5f88c",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/patriksimek/vm2/commit/fd266d084e0a3322d0f71ba2a8dc4c96cd030228",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.0",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-v37h-5mfm-c47c",
"source": "[email protected]",
"tags": [
"Exploit",
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26234",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36754",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-24781",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466531",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24781.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}