CVE-2026-45411: vm2 Has a Sandbox Breakout Using Async Generator

May 14, 2026

VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.

References

github.com/advisories/GHSA-248r-7h7q-cr24
github.com/patriksimek/vm2/commit/093494c0c3ef2390d2e56909f9d56e290e6f18b0
github.com/patriksimek/vm2/releases/tag/v3.11.3
github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24
nvd.nist.gov/vuln/detail/CVE-2026-45411

Code Behaviors & Features

Detect and mitigate CVE-2026-45411 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →