CVE-2026-44009

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44009
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44009.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44009
Aliases
Downstream
Published
2026-05-13T17:36:07Z
Modified
2026-11-05T03:31:27Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
vm2: Sandbox Breakout Through Null Proto Exception
Details

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-668"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44009.json"
}
References

Affected packages

Git / github.com/patriksimek/vm2

Affected ranges

Type
GIT
Repo
https://github.com/patriksimek/vm2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7a552e89e88bf34e0c3a33916aa7900efd9fd2f4
Fixed
c33c2bb19a822847f4e01d8d87b28dd5b2c86b3e
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "3.11.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "c33c2bb19a822847f4e01d8d87b28dd5b2c86b3e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v3.11.2",
            "range": [
                {
                    "fixed": "7a552e89e88bf34e0c3a33916aa7900efd9fd2f4"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

3.*
3.9.10
3.9.11
3.9.12
3.9.13
3.9.14
3.9.15
3.9.16
3.9.17
3.9.18
3.9.19
3.9.3
3.9.4
3.9.5
3.9.6
3.9.7
3.9.8
3.9.9
v3.*
v3.10.0
v3.10.1
v3.10.2
v3.10.3
v3.10.4
v3.10.5
v3.11.0
v3.11.1
v3.9.0
v3.9.1
v3.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44009.json"