Prototypal Manipulation Vulnerability in vm2 by Patrik Símek

CVE-2026-44005

What is CVE-2026-44005?

The vm2 library, a popular sandboxing solution for Node.js, has a vulnerability that allows attacker-controlled JavaScript execution to alter core host object prototypes such as Object.prototype, Array.prototype, and Function.prototype. This occurs due to mutable proxies that vm2 exposes, enabling writes from the sandbox to the underlying host realm. The flaw was present in versions 3.9.6 through 3.10.5, but was addressed in version 3.11.0. Users are advised to upgrade promptly to safeguard against this significant risk.

References