CVE-2026-44007
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
A vulnerability in the vm2 library for Node.js allows bypassing the require configuration in NodeVM with nesting enabled. Sandbox code can require the vm2 module, create a new NodeVM instance with unrestricted require, and execute arbitrary OS commands on the host.
Risk Assessment
The organization is at risk of full host compromise by an attacker who can run arbitrary code in a sandbox with nesting enabled. This leads to loss of confidentiality, integrity, and availability of the system.
Recommendation
Immediately update the vm2 library to version 3.11.1 or later. If an update is not possible, disable the nesting: true option in the NodeVM configuration.
Original NVD description (English source)
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised. This vulnerability is fixed in 3.11.1.