CVE-2026-24118

Katalog CVE

CVSS 9.8 · Critical EPSS 0,91%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada vm2 project vm2. Skor CVSS 3.1 9.8 (Critical) menurut github.com.

Deskripsi (NVD)

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.

Rincian

Terbit di NVD

4 Mei 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-693: Protection Mechanism Failure
CWE-749: Exposed Dangerous Method or Function

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 58,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35p exploit · advisory vendor
• https://github.com/patriksimek/vm2/commit/2b5f3e3a060d9088f5e1cdd585d683d491f990a3 patch
• https://github.com/patriksimek/vm2/commit/f9b700b1c7d9ef2df416666cb24e0b659140cc74 patch
• https://github.com/patriksimek/vm2/releases/tag/v3.11.0 release notes
• https://access.redhat.com/security/cve/CVE-2026-24118
• https://bugzilla.redhat.com/show_bug.cgi?id=2466502
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24118.json