CVE-2026-24118

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.

• CWE-94
• CWE-693
• CWE-749

• https://github.com/patriksimek/vm2/commit/2b5f3e3a060d9088f5e1cdd585d683d491f990a3Patch
• https://github.com/patriksimek/vm2/commit/f9b700b1c7d9ef2df416666cb24e0b659140cc74Patch
• https://github.com/patriksimek/vm2/releases/tag/v3.11.0Release Notes
• https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35pExploit, Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-24118
• https://bugzilla.redhat.com/show_bug.cgi?id=2466502
• https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35pExploit, Vendor Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24118.json

Published

May 4, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24112An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Att…9.8
• CVE-2026-24113An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Att…9.8
• CVE-2026-24114An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Fai…9.8
• CVE-2026-24115An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Fai…9.8
• CVE-2026-24116Wasmtime is a runtime for WebAssembly. Starting in version 2…5.5
• CVE-2026-24117Rekor is a software supply chain transparency log. In versio…5.3
• CVE-2026-2412The Quiz and Survey Master (QSM) plugin for WordPress is vul…6.5
• CVE-2026-24120vm2 is an open source vm/sandbox for Node.js. Prior to versi…9.8
• CVE-2026-24122Cosign provides code signing and transparency for containers…3.7
• CVE-2026-24123BentoML is a Python library for building online serving syst…6.5
• CVE-2026-24124Dragonfly is an open source P2P-based file distribution and …9.8
• CVE-2026-24125Tina is a headless content management system. Prior to 2.1.2…6.3