The patriksimek vm2 project, an open source sandbox for Node.js, contains a critical vulnerability identified as CVE-2026-26332. The issue involves improper control of code generation (CWE-94), where the SuppressedError feature can be exploited to break out of the sandbox environment and run arbitrary code on the host system. This vulnerability affects all vm2 versions before 3.11.0. The CVSS v3.1 score is 9.8, indicating a critical severity with network attack vector, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. The vulnerability has been addressed and patched in version 3.11.0. The Red Hat advisory linked confirms the existence of the vulnerability but does not explicitly state the patch status beyond the upstream fix.

Successful exploitation allows an unauthenticated attacker to escape the vm2 sandbox and execute arbitrary code on the host system, leading to complete compromise of confidentiality, integrity, and availability of the affected system. This poses a critical risk to environments using vulnerable versions of vm2.

Upgrade vm2 to version 3.11.0 or later, where this vulnerability has been patched. The vendor advisory confirms the fix is available upstream. No additional mitigations are indicated by the vendor advisory.