CVE-2026-24120

Katalog CVE

CVSS 9.8 · Critical EPSS 0,90%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada vm2 project vm2. Skor CVSS 3.1 9.8 (Critical) menurut github.com.

Deskripsi (NVD)

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.10.5.

Rincian

Terbit di NVD

4 Mei 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-693: Protection Mechanism Failure
CWE-807: Reliance on Untrusted Inputs in a Security Decision

EPSS (30 hari)

0,90% peluang dieksploitasi; lebih tinggi dari 58,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/patriksimek/vm2/security/advisories/GHSA-qvjj-29qf-hp7p exploit · advisory vendor
• https://github.com/patriksimek/vm2/releases/tag/v3.10.5 release notes
• https://access.redhat.com/security/cve/CVE-2026-24120
• https://bugzilla.redhat.com/show_bug.cgi?id=2466529
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24120.json