CVE-2026-44006 — vm2: Sandbox Escape

Description (CNA)

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

Affected (CNA)

Vendor / product	Versions
patriksimek / vm2	affected < 3.11.0

CWE

CWE-94

References

https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8

redhat-SADP

A flaw was found in vm2 (before 3.11.0). Sandboxed code can reach BaseHandler.getPrototypeOf to obtain arbitrary prototypes, enabling sandbox escape and arbitrary code execution. Fixed in 3.11.0.

https://access.redhat.com/security/cve/CVE-2026-44006
https://bugzilla.redhat.com/show_bug.cgi?id=2477200
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44006.json
https://access.redhat.com/errata/RHSA-2026:50850