Exploitation Summary
EIP tracks 1 public exploit for CVE-2026-24118. PoCs published by HORKimhab.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-24118, targeting a vulnerable version of the vm2 sandbox (3.10.1). The exploit leverages a prototype pollution or error handling vulnerability to escape the sandbox and achieve remote code execution (RCE) on the host system.
Description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.
Exploits (1)
This repository contains a functional exploit for CVE-2026-24118, targeting a vulnerable version of the vm2 sandbox (3.10.1). The exploit leverages a prototype pollution or error handling vulnerability to escape the sandbox and achieve remote code execution (RCE) on the host system.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H