CVE-2026-44009

CriticalCVSS 9.8

Published: 13/05/2026(UTC)Updated: 06/08/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.81%

54th percentile - higher than 54% of all known CVEs

A vulnerability in the vm2 library for Node.js allows sandbox escape. The issue is fixed in version 3.11.2.

An attacker can execute arbitrary code outside the sandbox, leading to full application compromise and system integrity breach.

Immediately update the vm2 library to version 3.11.2 or later.

Original NVD description (English source)

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, This vulnerability is fixed in 3.11.2.