{
  "threat_severity" : "Important",
  "public_date" : "2026-05-04T16:35:52Z",
  "bugzilla" : {
    "description" : "vm2: vm2: Arbitrary code execution via SuppressedError sandbox escape",
    "id" : "2466508",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2466508"
  },
  "cvss3" : {
    "cvss3_base_score" : "9.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-653",
  "details" : [ "vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.", "A flaw was found in vm2, an open-source sandbox for Node.js. This vulnerability allows a remote attacker to escape the sandbox environment by exploiting the `SuppressedError` mechanism. Successful exploitation can lead to arbitrary code execution on the host system, compromising the integrity and confidentiality of the affected system." ],
  "statement" : "This is an Important flaw in the vm2 Node.js sandbox, enabling a remote attacker to escape the sandbox and achieve arbitrary code execution. This happens because the sandbox fails to run rejection call backs within the sandbox isolation, an attacker that have privileges or tricks the user to run a maliciously crafted code can leverage that to cause suppressed errors to be handled in the host side instead of in the local side leading to the sandbox escape.\nRed Hat Developer Hub is not affected by this vulnerability as the `vm2` package is a development dependency and the code could not be reached by an adversary.",
  "package_state" : [ {
    "product_name" : "Red Hat Developer Hub",
    "fix_state" : "Not affected",
    "package_name" : "rhdh/rhdh-hub-rhel9",
    "cpe" : "cpe:/a:redhat:rhdh:1"
  }, {
    "product_name" : "Self-service automation portal 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform/automation-portal",
    "cpe" : "cpe:/a:redhat:ansible_portal:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-26332\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-26332\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.0\nhttps://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95" ],
  "name" : "CVE-2026-26332",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}