The open source Node.js sandbox vm2 version 3.10.4 is affected by a protection mechanism failure (CWE-693) that enables an attacker to escape the sandbox environment fully. By exploiting this vulnerability, attacker-controlled code running inside VM.run() can obtain the host process object and execute arbitrary commands on the host system with no required interaction or cooperation from the host. This issue is tracked as CVE-2026-26956 with a CVSS v3.1 score of 9.8 (critical). The vulnerability has been patched in vm2 version 3.10.5. The Red Hat advisory confirms the vulnerability and remediation.

Successful exploitation allows an attacker to bypass the vm2 sandbox protections and execute arbitrary code on the host system with the privileges of the host process running vm2. This leads to full compromise of the host environment, including confidentiality, integrity, and availability impacts.

Upgrade vm2 to version 3.10.5 or later, where this vulnerability is patched. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the Red Hat advisory linked in the source data.