CVE-2026-45411

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45411
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45411.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45411
Aliases
Downstream
Published
2026-05-13T17:38:38.311Z
Modified
2026-07-08T08:12:34.917181997Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
vm2: Sandbox Breakout Using Async Generator
Details

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield* iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.3.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45411.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-668"
    ]
}
References

Affected packages

Git / github.com/patriksimek/vm2

Affected ranges

Type
GIT
Repo
https://github.com/patriksimek/vm2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
093494c0c3ef2390d2e56909f9d56e290e6f18b0
Database specific 
{
    "cpe": "cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.11.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

3.*
3.9.10
3.9.11
3.9.12
3.9.13
3.9.14
3.9.15
3.9.16
3.9.17
3.9.18
3.9.19
3.9.3
3.9.4
3.9.5
3.9.6
3.9.7
3.9.8
3.9.9
v3.*
v3.10.0
v3.10.1
v3.10.2
v3.10.3
v3.10.4
v3.10.5
v3.11.0
v3.11.1
v3.11.2
v3.9.0
v3.9.1
v3.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45411.json"