CVE-2026-26332: VM2 Has a Sandbox Escape Issue via SuppressedError

Severity: Critical

CVSS Score: 9.8

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.