CVE-2026-44006

Published: May 13, 2026Modified: Jul 15, 2026

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

Affected (1)

Products: Vm2 Project: Vm2

Vm2 Project

1 product

Vm2

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vm2 Project Vm2	Before 3.11.0

Related CWEs

CWE-914

Improper Control of Dynamically-Identified Variables

The product does not properly restrict reading from or writing to dynamically-identified variables.

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (5)

https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8

Source: security-advisories@github.com

ExploitVendor Advisory

https://access.redhat.com/security/cve/CVE-2026-44006

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugzilla.redhat.com/show_bug.cgi?id=2477200

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44006.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Timeline

No history available yet.