CVE-2026-26956 affects vm2, an open source virtual machine/sandbox for Node.js. Version 3.10.4 contains a critical vulnerability allowing full sandbox escape with arbitrary code execution. Attackers can exploit code inside VM.run() to obtain the host process object and execute host commands without any host cooperation. This represents a complete compromise of the sandbox security model. The vulnerability has been addressed in version 3.10.5, and users should upgrade immediately to mitigate the risk.