CVE-2026-26332: vm2: vm2: Arbitrary code execution via SuppressedError sandbox escape

Severity: Critical

CVSS Score: 9.8

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.