Security readout for executives and security teams
Plain-English summary
CVE-2026-24118 is a critical sandbox escape in vm2, a Node.js library used to run code in isolation. If an application lets untrusted users submit code that runs inside vm2 before 3.11.0, an attacker could break out and execute commands on the host system.
Executive priority
Prioritize remediation for any service running untrusted code with vm2. The business risk is host compromise from a component intended to provide isolation, with potential data theft, service disruption, or broader system access.
Technical view
The issue affects patriksimek/vm2 versions before 3.11.0 and is described as a sandbox breakout through __lookupGetter__. The CVSS 3.1 score is 9.8, with network attack vector, no privileges, no user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely in Node.js services that depend on vm2 below 3.11.0, especially platforms executing customer, plugin, automation, workflow, or challenge code. Transitive dependencies should be checked; the source bundle does not identify other affected products.
Exploitation context
The provided sources say the flaw can allow arbitrary command execution on the host. KEV is false, and no cited source in the bundle confirms active exploitation. Treat internet-facing or multi-tenant untrusted-code execution as urgent exposure.
Researcher notes
Evidence supports critical severity, affected range below 3.11.0, and patch availability in 3.11.0. The bundle references commits and GitHub advisory material but does not provide confirmed exploitation telemetry or downstream product impact beyond vm2.
Mitigation direction
- Upgrade vm2 to version 3.11.0 or later.
- Regenerate and redeploy lockfiles and production artifacts after upgrading.
- Identify and reduce any vm2 execution of untrusted user-controlled code.
- Apply defense-in-depth isolation around code execution services.
- Monitor vendor, CVE, and Red Hat guidance for follow-up advisories.
Validation and detection
- Search package manifests and lockfiles for vm2 versions below 3.11.0.
- Check dependency trees for transitive vm2 usage.
- Map every code path that executes user-supplied code through vm2.
- Confirm production deployments include the patched dependency version.
- Review host logs for suspicious command execution from sandbox services.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-693: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-749: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-24118 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9GitHub_MCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H2.36redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-05-04T19:02:09.662Z: Reported to Red Hat.
- 2026-05-04T16:28:43.650Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35pCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/patriksimek/vm2/commit/2b5f3e3a060d9088f5e1cdd585d683d491f990a3CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/patriksimek/vm2/commit/f9b700b1c7d9ef2df416666cb24e0b659140cc74CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/patriksimek/vm2/releases/tag/v3.11.0CVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-24118CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2466502CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24118.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Protection Mechanism Failure
Protection Mechanism Failure represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Exposed Dangerous Method or Function
Exposed Dangerous Method or Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.