CVE-2026-44008 Details
Description
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host Function object. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.
A sandbox breakout vulnerability has been identified in vm2, an open-source virtual machine/sandbox for Node.js, affecting versions through 3.11.1. The issue arises in the method 'neutralizeArraySpeciesBatch', which can interact with objects from the host environment. This interaction exposes host objects, including the Function object, into the vm2 sandbox. Exploiting this vulnerability allows attackers to execute arbitrary commands on the host system, escaping the vm2 sandbox restrictions.
Users can upgrade to vm2 version 3.11.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:50850 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-44008 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477201 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44008.json | redhat-SADP | |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-9qj6-qjgg-37qq | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1100 | Insufficient Isolation of System-Dependent Functions | redhat-SADP |
| CWE-668 | Exposure of Resource to Wrong Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vm2 project vm2 | < 3.11.2 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |