Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-24120
9.8 CRITICAL
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
vm2: Sandbox Breakout Through Promise Species
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.10.5.
References
-
https://github.com/patriksimek/vm2/security/advisories/GHSA-qvjj-29qf-hp7p x_refsource_CONFIRM
-
https://github.com/patriksimek/vm2/releases/tag/v3.10.5 x_refsource_MISC
Affected products
vm2
- ==< 3.10.5
Matching in nixpkgs
pkgs.lvm2
Tools to support Logical Volume Management (LVM) on Linux
pkgs.lvm2_vdo
Tools to support Logical Volume Management (LVM) on Linux
pkgs.lvm2_dmeventd
Tools to support Logical Volume Management (LVM) on Linux
pkgs.docker-machine-kvm2
KVM2 driver for docker-machine
-
nixos-25.11 kvm2-1.37.0
- nixos-25.11-small kvm2-1.37.0
- nixpkgs-25.11-darwin kvm2-1.37.0
Package maintainers
-
@7c6f434c Michael Raskin <7c6f434c@mail.ru>
-
@ajs124 Andreas Schrägle <nix@ajs124.de>
-
@AtkinsChang Atkins Chang <atkinschang+nixpkgs@gmail.com>
-
@tadfisher Tad Fisher <tadfisher@gmail.com>