CVE-2026-45411 Details
Description
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield* iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.3.
A sandbox breakout vulnerability has been identified in vm2, an open-source virtual machine/sandbox for Node.js, affecting versions through 3.11.2. This vulnerability allows attackers to escape the vm2 sandbox and execute arbitrary commands on the host system. The issue arises from the ability to catch host exceptions using the yield* expression within an async generator. When the generator is closed with the return function, the awaited value can include exceptions thrown, which are then passed to the yield* iterator as the next value. This behavior can be exploited to execute unauthorized commands on the host.
Users can upgrade to vm2 version 3.11.3 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:50850 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-45411 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477210 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45411.json | redhat-SADP | |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-237 | Improper Handling of Structural Elements | redhat-SADP |
| CWE-668 | Exposure of Resource to Wrong Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vm2 project vm2 | < 3.11.3 |
CPE
Remediation
| |
Change History
12 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 7, 2026 | CVE Modified | redhat-SADP |
| Sep 4, 2026 | CVE Modified | redhat-SADP |
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | CVE Modified | [email protected] |
| Aug 6, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | New CVE Received | [email protected] |