{"id":"EUVD-2026-30071","enisaUuid":"f3ad52e9-848e-3cbb-86c8-e89a0cd1f779","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the onRejected callback in .then() and .catch() overrides and did not address the executor-to-unhandledRejection path. This vulnerability is fixed in 3.11.0.","datePublished":"May 13, 2026, 5:29:00 PM","dateUpdated":"Sep 7, 2026, 12:05:03 PM","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-hw58-p9xv-2mjh\n","aliases":"CVE-2026-44001\nGHSA-hw58-p9xv-2mjh\n","assigner":"GitHub_M","epss":0.45,"enisaIdProduct":[{"id":"64e5221e-e209-377d-8589-eaff727787b1","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.0"}],"enisaIdVendor":[{"id":"4306b998-e44a-3dd7-a08f-d99de154d2e9","vendor":{"name":"patriksimek"}}],"enisaIdVulnerability":[{"id":"1d0a66a8-d5ac-3db6-a11b-409a8bd8dd2b","vulnerability":{"id":"CVE-2026-44001","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the onRejected callback in .then() and .catch() overrides and did not address the executor-to-unhandledRejection path. This vulnerability is fixed in 3.11.0.","datePublished":"May 13, 2026, 5:29:00 PM","dateUpdated":"Sep 7, 2026, 12:05:03 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-hw58-p9xv-2mjh\n","enisa_id":"EUVD-2026-30071\n","assigner":"GitHub_M","epss":0.45,"dataProcessed":"Nov 7, 2026, 7:21:46 AM","vulnerabilityProduct":[{"id":"af67ef03-0231-3ba5-9fa8-0214f3fd16ea","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.0"}],"vulnerabilityVendor":[{"id":"7b4bd44d-8e4e-3ae4-96d5-23a3ead18ffe","vendor":{"name":"patriksimek"}}]}},{"id":"5e34470a-2c8d-335e-b427-2e3883ae362f","vulnerability":{"id":"GHSA-hw58-p9xv-2mjh","description":"vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)","datePublished":"May 7, 2026, 4:10:29 AM","dateUpdated":"May 14, 2026, 8:36:40 PM","baseScore":0.0,"references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-hw58-p9xv-2mjh\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44001\nhttps://github.com/advisories/GHSA-99p7-6v5w-7xg8\nhttps://github.com/patriksimek/vm2\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.0\n","enisa_id":"EUVD-2026-30071\n","aliases":"CVE-2026-44001\nGHSA-hw58-p9xv-2mjh\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"d74f10ea-a817-3c68-83e7-61b064d57f82","advisory":{"id":"RHSA-2026:50850","description":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update","summary":"Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.","datePublished":"Aug 5, 2026, 4:35:19 PM","dateUpdated":"Oct 31, 2026, 3:41:27 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:50850\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50850.json\n","aliases":"CVE-2026-9277\nCVE-2026-43997\nCVE-2026-43998\nCVE-2026-43999\nCVE-2026-44000\nCVE-2026-44001\nCVE-2026-44002\nCVE-2026-44003\nCVE-2026-44004\nCVE-2026-44005\nCVE-2026-44006\nCVE-2026-44007\nCVE-2026-44008\nCVE-2026-44009\nCVE-2026-45411\nCVE-2026-47131\nCVE-2026-47135\nCVE-2026-47137\nCVE-2026-47139\nCVE-2026-47140\nCVE-2026-47141\nCVE-2026-47209\nCVE-2026-48068\nCVE-2026-48801\nCVE-2026-59877\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"311ecff8-8324-3291-b7f2-d8b3178ab547","product":{"name":"registry.redhat.io/ansible-automation-platform/automation-portal@sha256:a85a548cb563a32be76c6e7e015fd57d340e068e321bf34b060d9eb901c33c4d_amd64","vendor":{"name":"Red Hat"}}},{"id":"31e60952-0a9a-3915-aadb-28544aea82d4","product":{"name":"Red Hat Ansible Automation Platform 2.1","vendor":{"name":"Red Hat"}}},{"id":"860f696f-a4de-3063-8cce-cf79cc54207b","product":{"name":"Self-service automation portal 2.1","vendor":{"name":"Red Hat"}}}]}}]}