AIKIDO-2026-10717
vm2 is vulnerable to Remote Code Execution
98
Critical Risk
This Affects:
vm2TL;DR
Guest code can influence inspection paths that rebuild host-side behavior from leaked representations. Attackers chain that to regain dangerous constructors and execute code on the host. The issue is a sandbox breakout through util.inspect-style plumbing rather than a normal guest API. The release hardens inspection-related bridging so those reconstructor gadgets are eliminated.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
vm2 is vulnerable to Remote Code Execution in versions 0.0.1 - 3.10.5.
How to fix this
Upgrade the vm2 library to the patch version.
Links
GitHub Release
Fix Commits
github.com/patriksimek/vm2/commit/8d30d93213c1898b3e035298b89a814970dd1189github.com/patriksimek/vm2/commit/bdd3d15e57bc4ec5e70365cd79f7cb0256e5f88cgithub.com/patriksimek/vm2/commit/fd266d084e0a3322d0f71ba2a8dc4c96cd030228Other
access.redhat.com/errata/RHSA-2026:26234access.redhat.com/errata/RHSA-2026:36754access.redhat.com/security/cve/CVE-2026-24781bugzilla.redhat.com/show_bug.cgi?id=2466531security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24781.json
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant