# CVE-2026-26332: patriksimek vm2 sandbox escape via SuppressedError

Source: https://junglewise.ai/threats/cve-2026-26332-patriksimek-vm2-sandbox-escape-via-suppressederror  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-26332 · Severity: critical · CVSS 9.8 · Published 2026-05-04

VM2 is a popular Node.js library used to safely execute untrusted code in an isolated sandbox environment. An attacker can exploit a flaw in how the library handles Promise rejection errors to break out of the sandbox and execute arbitrary system commands with the privileges of the host process, completely bypassing the sandbox protection.

Technologies: [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2), [Red Hat Developer Hub](https://junglewise.ai/threats/technologies/developer-hub), [Red Hat Self-service automation portal](https://junglewise.ai/threats/technologies/self-service-automation-portal). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-26332 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26332 being exploited in the wild.

**How severe is CVE-2026-26332?** Critical severity, with a CVSS score of 9.8, published 4 May 2026.

**Which products and versions are affected?** vm2 (npm) < 3.11.0, SEMVER:introduced=0,fixed=3.11.0; Red Hat Developer Hub 1; Red Hat Self-service automation portal 2.

**Is there a fix for CVE-2026-26332?** Yes. vm2 (npm): upgrade to 3.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-26332 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-26332?** Check whether you run vm2 (npm), Red Hat Developer Hub or Red Hat Self-service automation portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vm2 (npm): upgrade to 3.11.0 or later

  ```sh
  npm install vm2@3.11.0
  ```


## Technical details

The vulnerability exists in VM2's promise handling at the host-sandbox boundary. When an embedder exposes a host-realm async function to sandboxed code via the sandbox options, the bridge returns a host-realm Promise wrapped as a proxy. However, when the sandbox calls `.then()`, `.catch()`, or `.finally()` on this proxy, the promise chain invokes callbacks against raw host rejection values, bypassing the sandbox's `handleException` sanitization layer. This allows a SuppressedError thrown in the host realm to reach the sandbox catch handler unsanitized. An attacker can then access the error's `.constructor.constructor` property chain to obtain the host Function constructor, enabling arbitrary code execution via eval-like patterns. The vulnerability affects VM2 versions ≤ 3.10.4 and requires no authentication or user interaction; exploitation is triggered by sandboxed code alone. A patch is available in v3.11.0 which enforces structural sanitization at the host-Promise boundary by wrapping all callbacks through sandbox-side sanitizing closures.

## Affected products

- patriksimek vm2 <= 3.10.4

## Identifiers

- CVE-2026-26332
- GHSA-55hx-c926-fr95

## Timeline

- 2026-05-05: disclosed
- 2026-05-01: patched: Fix released in v3.11.0

## References

- [https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95](https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95)
- [https://github.com/patriksimek/vm2/commit/119fd0aa1e4c27b08cf37946b2dafa99e2c754f0](https://github.com/patriksimek/vm2/commit/119fd0aa1e4c27b08cf37946b2dafa99e2c754f0)
- [https://github.com/patriksimek/vm2/commit/4cb82cc94d9bb6c9a918b45f8c6790c32a5e913f](https://github.com/patriksimek/vm2/commit/4cb82cc94d9bb6c9a918b45f8c6790c32a5e913f)
- [https://github.com/patriksimek/vm2/commit/7395c3a4b01d302e55271c87dbeb44d6b83b81ca](https://github.com/patriksimek/vm2/commit/7395c3a4b01d302e55271c87dbeb44d6b83b81ca)
- [https://github.com/patriksimek/vm2/commit/792e16d56ee429ab19e284ed9c545f5e4694fb7d](https://github.com/patriksimek/vm2/commit/792e16d56ee429ab19e284ed9c545f5e4694fb7d)
- [https://github.com/patriksimek/vm2/commit/d715dd88c5aec5bbb4dce03ddf7c3eb3791d0338](https://github.com/patriksimek/vm2/commit/d715dd88c5aec5bbb4dce03ddf7c3eb3791d0338)

## Related threats

- [vm2 NodeVM path bypass in custom resolution](https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-custom-resolution-bypasses-external-path-5d3a7272)
- [vm2 NodeVM zlib buffer pool information disclosure](https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-zlib-buffers-expose-pooled-host-memory-6007c734)
- [vm2 host Promise rejection denial of service in construct trap](https://junglewise.ai/threats/duplicate-advisory-vm2-host-promise-rejection-from-an-exposed-f7aba6ba)
- [vm2 sandbox escape via Buffer backing-store ownership bypass](https://junglewise.ai/threats/cve-2026-100723-vm2-before-3-12-2-does-not-apply-its-buffer-backing-store)
- [vm2 unhandled Promise rejection in construct trap](https://junglewise.ai/threats/cve-2026-100722-vm2-before-3-12-2-does-not-apply-host-side-promise-rejection)