CVE-2026-44007
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk55th percentile — higher than 55% of all known CVEs
Summary
In vm2 prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration, including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with unrestricted require settings and executes arbitrary OS commands on the host.
Risk Assessment
Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised, potentially leading to full host takeover and arbitrary command execution by the attacker.
Recommendation
Immediately update vm2 to version 3.11.1 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised. This vulnerability is fixed in 3.11.1.