CVE-2026-24120: VM2 Has Sandbox Breakout Through Promise Species

May 5, 2026

The fix for https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.

References

github.com/advisories/GHSA-qvjj-29qf-hp7p
github.com/patriksimek/vm2/releases/tag/v3.10.5
github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
github.com/patriksimek/vm2/security/advisories/GHSA-qvjj-29qf-hp7p
nvd.nist.gov/vuln/detail/CVE-2026-24120

Code Behaviors & Features

Detect and mitigate CVE-2026-24120 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →