CVE-2026-44008CWE-1100CWE-668

CVE-2026-44008

Critical · published May 13, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
55.8
In the wild
Unconfirmed
What it is

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host Function object. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00851 · 55.8th percentile
Weaknesses
CWE-1100 · Insufficient Isolation of System-Dependent Functions; CWE-668 · Exposure of Resource to Wrong Sphere
Published
2026-05-13T22:16Z
Affected products (1)
ProductVersionsFixed in
vm2_project/vm2< 3.11.23.11.2
References (5)
https://github.com/patriksimek/vm2/security/advisories/GHSA-9qj6-qjgg-37qq · [email protected]https://access.redhat.com/errata/RHSA-2026:50850 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/security/cve/CVE-2026-44008 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2477201 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44008.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 13 MAY 17:35Z
    vm2: Snabox breakout via `neutralizeArraySpeciesBatch`
    cvelistv5