CVE-2026-24118 — AI Deep Analysis Summary

🚨 **Essence**: VM2 (Node.js sandbox) has a **Sandbox Escape** flaw. <br>💥 **Consequences**: Attackers break out of the isolated VM environment. <br>⚠️ **Impact**: Arbitrary command execution on the **host system**.…

🛡️ **CWE**: CWE-94 (Code Injection). <br>🔍 **Flaw**: Improper neutralization of special elements in code. <br>📉 **Root**: The sandbox mechanism fails to restrict specific code patterns, allowing host-level access.

📦 **Product**: `vm2` by `patriksimek`. <br>📅 **Affected**: Versions **< 3.11.0**. <br>🌐 **Context**: Any Node.js app using VM2 for untrusted code execution is at risk.

👑 **Privileges**: **Host System** access. <br>💾 **Data**: Full read/write access to host files. <br>🔓 **Action**: Execute **arbitrary commands** (RCE).…

🚪 **Auth**: None required (PR:N). <br>🌐 **Network**: Remote (AV:N). <br>🎯 **Complexity**: Low (AC:L). <br>👤 **UI**: None needed (UI:N). <br>✅ **Threshold**: **Very Low**. Easy to exploit if VM2 is exposed.

📜 **Public Exploit**: No specific PoC code in data (pocs: []). <br>🔗 **Advisory**: Confirmed via GitHub Security Advisory (GHSA-grj5-jjm8-h35p).…

🔍 **Check**: Scan for `vm2` dependency in `package.json`. <br>📊 **Version**: Verify version is **< 3.11.0**. <br>🛠️ **Tool**: Use SCA tools to detect vulnerable `vm2` packages in your project.

✅ **Fixed**: Yes. <br>🔧 **Patch**: Upgrade to **v3.11.0** or later. <br>🔗 **Source**: See GitHub Release v3.11.0 and commit f9b700b1c7d9. <br>📝 **Status**: Officially resolved.

🚫 **No Patch?**: **Stop using VM2** for untrusted input. <br>🔄 **Alternative**: Use `isolated-vm` or Node.js `Worker Threads` (more secure). <br>🛡️ **Mitigation**: Run in restricted containers with minimal privileges.

🔥 **Urgency**: **CRITICAL**. <br>🚀 **Priority**: **P0 / Immediate Action**. <br>💡 **Reason**: Remote Code Execution (RCE) with low barrier. <br>⏱️ **Action**: Patch immediately to prevent host compromise.