CVE-2026-26956

Katalog CVE

CVSS 9.8 · Critical EPSS 0,92%

Kerentanan Protection Mechanism Failure pada vm2 project vm2. Skor CVSS 3.1 9.8 (Critical) menurut github.com.

Deskripsi (NVD)

vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation. This issue has been patched in version 3.10.5.

Rincian

Terbit di NVD

4 Mei 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-693: Protection Mechanism Failure
CWE-653: Improper Isolation or Compartmentalization

EPSS (30 hari)

0,92% peluang dieksploitasi; lebih tinggi dari 59,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/patriksimek/vm2/security/advisories/GHSA-ffh4-j6h5-pg66 exploit · advisory vendor
• https://github.com/patriksimek/vm2/releases/tag/v3.10.5 release notes
• https://access.redhat.com/security/cve/CVE-2026-26956
• https://bugzilla.redhat.com/show_bug.cgi?id=2466548
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26956.json