ИнструментыУязвимости БДУБлоклистыРасширениеУтилитыБлогAPIМониторинг
Главная → Уязвимости → CVE-2026-26332
9.8критическая

CVE-2026-26332

Описание

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.

Затрагиваемое ПО
Vm2 project Vm2
CVSS
Балл9.8 — критическая
ВекторCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Источники
https://github.com/patriksimek/vm2/releases/tag/v3.11.0https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95https://access.redhat.com/security/cve/CVE-2026-26332https://bugzilla.redhat.com/show_bug.cgi?id=2466508https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26332.json