CVE-2026-44006

CriticalCVSS 10.0

Published: 13/05/2026(UTC)Updated: 06/08/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.82%

54th percentile - higher than 54% of all known CVEs

Summary

A vulnerability in the vm2 library for Node.js allows an attacker to bypass sandboxing and access arbitrary object prototypes. The issue is fixed in version 3.11.0.

Risk Assessment

An attacker can exploit this flaw to gain unauthorized access to prototypes, potentially leading to privilege escalation and arbitrary code execution in the Node.js environment.

Recommendation

Immediately update the vm2 library to version 3.11.0 or later. If an update is not possible, consider temporarily disabling sandboxing functionality.

Original NVD description (English source)

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.