Sandbox Boundary Violation in vm2 by patriksimek
CVE-2026-44000

6.5MEDIUM

Key Information:

Vendor

Patriksimek

Status
Vm2
Vendor
CVE Published:
13 May 2026

What is CVE-2026-44000?

The vm2 library for Node.js contains a vulnerability that allows for a sandbox boundary violation. Prior to version 3.11.0, a flaw in the Promise resolution mechanism allows host objects to be improperly accessed from within the sandbox environment. This occurs when a host-side Promise is resolved to a host object, enabling the sandbox to communicate with and potentially alter the state of host objects directly. The erroneous use of ensureThis() in the fulfillment wrapper leads to this breach of isolation, permitting the resolved objects to escape the sandbox. The vulnerability has been addressed in version 3.11.0.

Affected Version(s)

vm2 < 3.11.0

References

https://github.com/patriksimek/vm2/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.