CVE-2026-26332
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
May 04, 2026
Vendor
unknown
Description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.