Is CVE-2026-24120 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24120 being exploited in the wild.

How severe is CVE-2026-24120?

Critical severity, with a CVSS score of 9.8, published 4 May 2026.

Which products and versions are affected?

vm2 (npm) SEMVER:introduced=0,fixed=3.10.5; Red Hat Developer Hub 1; Red Hat Self-service automation portal 2 2.

Is there a fix for CVE-2026-24120?

Yes. vm2 (npm): upgrade to 3.10.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24120 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-24120?

Check whether you run vm2 (npm), Red Hat Developer Hub or Red Hat Self-service automation portal 2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24120: patriksimek vm2 sandbox escape via Promise species bypass

CVE-2026-24120 · Severity: critical · CVSS 9.8 · Published 2026-05-04

vm2 is a popular software library used to run untrusted code in a restricted 'sandbox' environment within Node.js applications. A critical vulnerability allows attackers to break out of this restricted environment and execute commands directly on the underlying server. This could lead to a full system takeover, unauthorized data access, or complete service disruption.

Technologies: vm2 (npm), Red Hat Developer Hub, Red Hat Self-service automation portal 2. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-24120 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24120 being exploited in the wild.
How severe is CVE-2026-24120?: Critical severity, with a CVSS score of 9.8, published 4 May 2026.
Which products and versions are affected?: vm2 (npm) SEMVER:introduced=0,fixed=3.10.5; Red Hat Developer Hub 1; Red Hat Self-service automation portal 2 2.
Is there a fix for CVE-2026-24120?: Yes. vm2 (npm): upgrade to 3.10.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24120 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-24120?: Check whether you run vm2 (npm), Red Hat Developer Hub or Red Hat Self-service automation portal 2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vm2 (npm): upgrade to 3.10.5 or later
```
npm install vm2@3.10.5
```

Technical details

A sandbox escape vulnerability exists in vm2 due to an insufficient fix for CVE-2023-37466. The original mitigation utilized a 'resetPromiseSpecies' function to protect the Promise species property; however, an attacker can overwrite 'Object.defineProperty' and 'Array.prototype.includes' to prevent this reset from occurring. By manipulating the 'Symbol.species' property of a Promise and triggering an error stack trace, an attacker can acquire the host's 'process' object. This allows for arbitrary command execution via 'child_process' on the host system. The vulnerability is reachable by any user capable of providing code to be executed within the vm2 sandbox. The issue is patched in version 3.10.5.

Affected products

patriksimek vm2 <= 3.10.3
Red Hat Red Hat Developer Hub 1
Red Hat Self-service automation portal 2 2

Identifiers

CVE-2026-24120
GHSA-qvjj-29qf-hp7p

Timeline

2026-05-01: advisory: GitHub Security Advisory GHSA-qvjj-29qf-hp7p published
2026-05-04: disclosed: CVE-2026-24120 published to NVD
2026-02-17: patched: Version 3.10.5 released to address the escape vectors

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.