VM2 version prior to 3.11.0 contains a critical sandbox escape vulnerability via the SuppressedError feature in Node.js v24.13.0. This flaw allows attackers to execute arbitrary code outside the sandbox environment. The vulnerability is identified as CVE-2026-26332 and has a CVSS score of 9.8, indicating a critical severity level. A proof-of-concept demonstrates how an attacker can leverage error handling to run system commands. The issue is fixed in VM2 version 3.11.0.