AIKIDO-2026-10808
vm2 is vulnerable to Remote Code Execution
98
Critical Risk
This Affects:
vm2TL;DR
Affected versions of vm2 contain a sandbox escape vulnerability that allows attackers to bypass the isolation mechanism and execute arbitrary commands on the host system. By abusing exception handling behavior in async generators and yield*, a malicious user can break out of the sandbox and achieve remote code execution.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
vm2 is vulnerable to Remote Code Execution in versions 0.0.1 - 3.11.2.
How to fix this
Upgrade the vm2 library to the patch version.
Links
GitHub Release
Other
access.redhat.com/errata/RHSA-2026:50850access.redhat.com/security/cve/CVE-2026-45411bugzilla.redhat.com/show_bug.cgi?id=2477210security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45411.json
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant