ROOT-APP-NPM-CVE-2026-24781 CVE-2026-24781 in @rootio/vm2 - Patched by Root

Root has patched CVE-2026-24781 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

CVE-2026-24781

creationtimestamp| type| source ---|---|--- 2026-05-04 18:30:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2cks5l6l26 2026-05-08 22:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mleqj3brke26 2026-07-09 07:48:04+00:00| seen|...

org.webjars.npm:degenerator (=4.0.4), org.webjars.npm:pac-resolver (=6.0.2) +1 more potentially affected by CVE-2026-24781 via org.webjars.npm:vm2 (=3.9.19)

org.webjars.npm:vm2 MAVEN version =3.9.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:vm2 and may be impacted: - org.webjars.npm:degenerator =4.0.4 - org.webjars.npm:pac-resolver =6.0.2 - org.webjars.npm:rocket.chatapps-engine =1.35...

@aiconnect/codelets-runner (>=0.1.0 <=0.2.0), @cairncms/api (>=1.0.0-beta.1 <=1.0.0-beta.4) +16 more potentially affected by CVE-2026-24781 via vm2 (>=3.0.0 <=3.10.5)

vm2 NPM version =3.0.0, =0.1.0, =1.0.0-beta.1, =3.0.46, =1.0.0-beta.1, =0.1.64, =0.1.61, =1.66.16, =1.66.16, =1.66.16, =1.66.16, =1.66.16, =1.66.16, =1.66.16, =1.72.1 and more Source cves: CVE-2026-24781 Source advisory: SNYK:JS-VM2-16419539...

CVE-2026-24781 vm2: Sandbox Breakout Through Inspect

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been...