Vendor
critical
threat
NodeVM Sandbox Escape via Unrestricted OS and DNS Built-ins
2 TTPsThe vm2 sandbox library fails to restrict the 'os' and 'dns' built-in modules when using the 'builtin: ['*']' configuration, enabling host-level information disclosure and process-wide DNS hijacking.
NodeVM
vm2
nodejs
sandbox-escape
supply-chain
2t
high
advisory
vm2 Vulnerability Allows Code Execution
2 rules 1 TTPA remote, anonymous attacker can exploit a vulnerability in vm2 to execute arbitrary code, potentially leading to arbitrary code execution on the host system.
vm2
javascript-sandbox
code-execution
2r
1t
critical
advisory
VM2 Sandbox Escape Vulnerability (CVE-2026-26956)
2 rules 2 TTPs 1 CVEA critical vulnerability, CVE-2026-26956, exists in vm2 version 3.10.4 when running on Node.js v25.6.1 (x64 Linux), allowing a full sandbox escape with arbitrary code execution through attacker-controlled code passed to `VM.run()`.
vm2 +1
sandbox-escape
wasm
javascript
2r
2t
1c