{"id":"EUVD-2026-26993","enisaUuid":"84533851-891f-3b5c-a729-d72417697f1a","description":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.","datePublished":"May 4, 2026, 4:35:52 PM","dateUpdated":"Jul 15, 2026, 1:14:58 AM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.0\n","aliases":"CVE-2026-26332\n","assigner":"GitHub_M","epss":0.71,"enisaIdProduct":[{"id":"cd6b709b-45dc-37f4-9b39-a3a143dda1e1","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.0"}],"enisaIdVendor":[{"id":"ee5ab60b-1ff1-35b5-9779-a88ac89f8e7c","vendor":{"name":"patriksimek"}}],"enisaIdVulnerability":[{"id":"81a07bfd-673f-3302-b3fb-682170b14802","vulnerability":{"id":"GHSA-55hx-c926-fr95","description":"VM2 Has a Sandbox Escape Issue via SuppressedError","datePublished":"May 5, 2026, 4:33:45 PM","dateUpdated":"Nov 4, 2026, 3:29:30 AM","baseScore":0.0,"references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-26332\nhttps://github.com/patriksimek/vm2/commit/119fd0aa1e4c27b08cf37946b2dafa99e2c754f0\nhttps://github.com/patriksimek/vm2/commit/4cb82cc94d9bb6c9a918b45f8c6790c32a5e913f\nhttps://github.com/patriksimek/vm2/commit/7395c3a4b01d302e55271c87dbeb44d6b83b81ca\nhttps://github.com/patriksimek/vm2/commit/792e16d56ee429ab19e284ed9c545f5e4694fb7d\nhttps://github.com/patriksimek/vm2/commit/d715dd88c5aec5bbb4dce03ddf7c3eb3791d0338\nhttps://access.redhat.com/security/cve/CVE-2026-26332\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2466508\nhttps://github.com/patriksimek/vm2\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.0\nhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26332.json\n","enisa_id":"EUVD-2026-26993\n","aliases":"GHSA-55hx-c926-fr95\nCVE-2026-26332\n","epss":0.0,"dataProcessed":"Nov 5, 2026, 7:04:01 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c6aa4719-139b-3984-865f-4c600cdcacce","vulnerability":{"id":"CVE-2026-26332","description":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.","datePublished":"May 4, 2026, 4:35:52 PM","dateUpdated":"Jul 15, 2026, 1:14:58 AM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.0\n","enisa_id":"EUVD-2026-26993\n","assigner":"GitHub_M","epss":0.71,"dataProcessed":"Nov 5, 2026, 7:20:09 AM","vulnerabilityProduct":[{"id":"99e486c8-3ed4-3c26-a89c-ba5534eba0f7","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.0"}],"vulnerabilityVendor":[{"id":"e9263230-ddfa-374a-9d29-394197f0936a","vendor":{"name":"patriksimek"}}]}}],"enisaIdAdvisory":[{"id":"6a41cbc1-c7f4-3304-8449-be5650b8e77e","advisory":{"id":"WID-SEC-W-2026-1349","description":"vm2: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.","datePublished":"May 3, 2026, 10:00:00 PM","dateUpdated":"May 4, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1349.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-1349\n","aliases":"CVE-2026-22709\nCVE-2026-24118\nCVE-2026-24120\nCVE-2026-24781\nCVE-2026-26332\nCVE-2026-26956\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"0eb4abcf-9e73-35c3-8c6d-c5bb6bbc8cc9","product":{"name":"Open Source vm2","vendor":{"name":"open source"}}},{"id":"1b990204-4dea-3ef1-ab56-55008fbee317","product":{"name":"3.11.1","vendor":{"name":"open source"}}},{"id":"9efe5507-75d5-3d08-bcd8-7b2a6eeb4417","product":{"name":"vm2","vendor":{"name":"patriksimek"}}}]}}]}