Unauthorized Access Vulnerability in vm2 Sandbox for Node.js
CVE-2026-44009

9.8CRITICAL

Key Information:

Vendor

Patriksimek

Status
Vm2
Vendor
CVE Published:
13 May 2026

What is CVE-2026-44009?

The vm2 project is an open-source sandbox for Node.js, which allows users to run untrusted code securely. Prior to version 3.11.2, a vulnerability existed that could potentially allow unauthorized users to gain access to sensitive information or perform unintended actions within the sandbox environment. It is crucial for users to upgrade to version 3.11.2 or later to mitigate these risks and enhance the security of their applications.

Affected Version(s)

vm2 < 3.11.2

References

https://github.com/patriksimek/vm2/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.