Node.js Sandbox Issue in vm2 Affects Multiple Applications
CVE-2026-44007

9.1CRITICAL

Key Information:

Vendor

Patriksimek

Status
Vm2
Vendor
CVE Published:
13 May 2026

What is CVE-2026-44007?

The vm2 library, an open-source virtual machine/sandbox for Node.js, contains a critical vulnerability that allows sandboxed code to unconditionally access the 'vm2' module. This occurs when a NodeVM is instantiated with nesting set to true, overriding the outer VM's require settings. Consequently, malicious code can create a new inner NodeVM with unrestricted permissions, leading to arbitrary command execution on the host OS. Applications utilizing this configuration are at severe risk when running untrusted code. The vulnerability has been addressed in version 3.11.1.

Affected Version(s)

vm2 < 3.11.1

References

https://github.com/patriksimek/vm2/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.