CVE-2026-24120 - Vulnerability Analysis

Overview

vm2 < 3.10.5 contains a sandbox escape vulnerability caused by insufficient fix for CVE-2023-37466, letting attackers execute arbitrary commands on the host system, exploit requires crafted code execution within the sandbox.

Severity & Score

Impact

Attackers can escape the sandbox and execute arbitrary commands on the host, leading to full system compromise.

Mitigation

Upgrade to version 3.10.5 or later.

References

• https://github.com/patriksimek/vm2/releases/tag/v3.10.5
• https://github.com/patriksimek/vm2/security/advisories/GHSA-qvjj-29qf-hp7p

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner