Loading vulnerability…
vm2 SuppressedError Sandbox Escape
CVE-2026-26332 is a critical sandbox escape vulnerability in vm2, the Node.js sandbox library. In vulnerable versions, vm2 improperly handles the JavaScript SuppressedError object associated with Explicit Resource Management features such as DisposableStack. By triggering a SuppressedError inside the sandbox, attacker-controlled code can access host-realm constructor references through the suppressed exception object, including a path to the host Function constructor. This breaks vm2’s isolation boundary and allows sandboxed code to execute arbitrary code in the host Node.js environment. The issue affects vm2 versions prior to 3.11.0, with reporting indicating exploitation against versions up to and including 3.10.4, and it was fixed in version 3.11.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a remote, unauthenticated attacker who can supply JavaScript to a vm2 sandbox to escape the sandbox and achieve arbitrary code execution in the host Node.js process. This can lead to full compromise of confidentiality, integrity, and availability on the host, including execution of operating system commands, access to application secrets and data, modification of host state, and potential follow-on lateral movement depending on the privileges of the hosting process.
If you can’t patch tonight, do this now.
If immediate patching is not possible, stop using vm2 to execute untrusted or attacker-controlled JavaScript until the fixed version is deployed. Reduce exposure by disabling or restricting untrusted code execution paths, isolating the execution environment at the process, container, or microVM boundary, and running the hosting service with minimal privileges and limited access to sensitive host resources. Additional compensating controls may reduce blast radius, but they do not reliably prevent exploitation of this sandbox escape.
Patch, then assume compromise.
Upgrade vm2 to version 3.11.0 or later. Because vm2 has a recurring history of sandbox escape vulnerabilities, operators should also review subsequent security releases and move to the latest supported version rather than stopping at the minimum fixed release. Validate that all deployments, transitive dependencies, and embedded copies of vm2 are updated consistently.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.