Sandbox Escape Vulnerability in vm2 by Patrik Simek
CVE-2026-44008

9.8CRITICAL

Key Information:

Vendor

Patriksimek

Status
Vm2
Vendor
CVE Published:
13 May 2026

What is CVE-2026-44008?

The vm2 library, an open-source VM/sandbox for Node.js, contains a flaw that allows attackers to escape the sandbox environment. Prior to version 3.11.2, the 'neutralizeArraySpeciesBatch' method incorrectly interacts with objects from the other side, enabling potential attackers to access host objects and the host Function object. This vulnerability can be exploited to execute arbitrary commands on the host system, compromising security and integrity. Users are advised to upgrade to version 3.11.2 or later to mitigate this risk.

Affected Version(s)

vm2 < 3.11.2

References

https://github.com/patriksimek/vm2/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.