{"action":"Upgrade vm2 to 3.10.2 or later.","affected":[{"fixed":"3.10.2","introduced":"0"}],"component":"vm2","cve_ids":["CVE-2026-22709"],"ecosystem":"npm","epss":0.0127,"exploited":false,"fixed_versions":["3.10.2"],"ghsa_id":"GHSA-99p7-6v5w-7xg8","id":"tcs_01M5KFFC28560DD6HAFG79X9TB","modified_at":"2026-02-03T03:05:10.011021Z","published_at":"2026-01-26T18:57:14Z","references":["https://osv.dev/vulnerability/GHSA-99p7-6v5w-7xg8","https://github.com/patriksimek/vm2/security/advisories/GHSA-99p7-6v5w-7xg8","https://nvd.nist.gov/vuln/detail/CVE-2026-22709","https://github.com/patriksimek/vm2/commit/4b009c2d4b1131c01810c1205e641d614c322a29","https://github.com/patriksimek/vm2","https://github.com/patriksimek/vm2/releases/tag/v3.10.2"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-99p7-6v5w-7xg8","url":"https://osv.dev/vulnerability/GHSA-99p7-6v5w-7xg8"}],"summary":"vm2 has a Sandbox Escape"}