CVE-2026-44006

vm2: Sandbox Escape

State: Published
Severity: 10.0 Critical
Published: May 13, 2026
Updated: Sep 7, 2026
Reserved: May 4, 2026

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	GitHub_M
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	redhat-SADP

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-914 Improper Control of Dynamically-Identified Variables

Affected Products

Product	Versions
vm2patriksimek	< 3.11.0Affected

References

https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8
https://access.redhat.com/security/cve/CVE-2026-44006vdb-entry
RHBZ#2477200issue-tracking
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44006.json
https://access.redhat.com/errata/RHSA-2026:50850vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.