CVE-2026-22709

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

January 27, 2026

Last Seen

May 6, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical vm2 Vulnerability Allows Arbitrary Code Execution on Host Systems72.9

A critical vulnerability (CVE-2026-26956) in the vm2 Node.js sandboxing library enables attackers to escape the sandbox and execute arbitrary code on host systems. This flaw affects vm2 version 3.10.4 and earlier, particularly in environments running Node.js 25 with WebAssembly exception handling en...

Critical vm2 Vulnerability in Node.js Allows Code Execution45.3

A critical vulnerability in the vm2 sandboxing library for Node.js has been identified, enabling attackers to escape the sandbox and execute arbitrary code on affected systems. This flaw poses a significant risk to applications utilizing the vm2 library, which is widely used for running untrusted co...