{"id":"EUVD-2026-30073","enisaUuid":"0f47b28e-9687-363e-a641-886ca9455535","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2\u0027s code transformer has a performance optimization that skips AST analysis when the code does not contain catch, import, or async keywords. This fast-path bypass allows sandboxed code to directly access the internal VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL variable, which exposes internal security functions (handleException, wrapWith, import). This vulnerability is fixed in 3.11.0.","datePublished":"May 13, 2026, 5:30:38 PM","dateUpdated":"May 13, 2026, 6:41:25 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7\n","aliases":"CVE-2026-44003\nGHSA-wp5r-2gw5-m7q7\n","assigner":"GitHub_M","epss":0.25,"enisaIdProduct":[{"id":"7a8772b0-9431-387c-a3e8-423753d0b6bf","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.0"}],"enisaIdVendor":[{"id":"d8d0aa41-e20a-3a86-96ad-b0237ced9405","vendor":{"name":"patriksimek"}}],"enisaIdVulnerability":[{"id":"009c6a0b-6853-3676-b2fa-b3cee57610a5","vulnerability":{"id":"GHSA-wp5r-2gw5-m7q7","description":"vm2\u0027s Transformer Fast-Path Bypass Exposes Internal State Variable","datePublished":"May 7, 2026, 4:32:56 AM","dateUpdated":"May 14, 2026, 8:36:55 PM","baseScore":0.0,"references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44003\nhttps://github.com/patriksimek/vm2\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.0\n","enisa_id":"EUVD-2026-30073\n","aliases":"GHSA-wp5r-2gw5-m7q7\nCVE-2026-44003\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e5585ce3-7bd8-377d-a8f5-c25ff3d7f540","vulnerability":{"id":"CVE-2026-44003","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2\u0027s code transformer has a performance optimization that skips AST analysis when the code does not contain catch, import, or async keywords. This fast-path bypass allows sandboxed code to directly access the internal VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL variable, which exposes internal security functions (handleException, wrapWith, import). This vulnerability is fixed in 3.11.0.","datePublished":"May 13, 2026, 5:30:38 PM","dateUpdated":"May 13, 2026, 6:41:25 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7\n","enisa_id":"EUVD-2026-30073\n","assigner":"GitHub_M","epss":0.25,"dataProcessed":"Nov 5, 2026, 7:18:05 AM","vulnerabilityProduct":[{"id":"0981a17c-0603-3c1c-bc82-0348a25f0344","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.0"}],"vulnerabilityVendor":[{"id":"2da2f127-55c7-321d-b953-4cd2dfe5fd29","vendor":{"name":"patriksimek"}}]}}],"enisaIdAdvisory":[{"id":"a7c642d5-4435-3ced-adba-fc71f2a874da","advisory":{"id":"RHSA-2026:50850","description":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update","summary":"Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.","datePublished":"Aug 5, 2026, 4:35:19 PM","dateUpdated":"Oct 31, 2026, 3:41:27 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:50850\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50850.json\n","aliases":"CVE-2026-9277\nCVE-2026-43997\nCVE-2026-43998\nCVE-2026-43999\nCVE-2026-44000\nCVE-2026-44001\nCVE-2026-44002\nCVE-2026-44003\nCVE-2026-44004\nCVE-2026-44005\nCVE-2026-44006\nCVE-2026-44007\nCVE-2026-44008\nCVE-2026-44009\nCVE-2026-45411\nCVE-2026-47131\nCVE-2026-47135\nCVE-2026-47137\nCVE-2026-47139\nCVE-2026-47140\nCVE-2026-47141\nCVE-2026-47209\nCVE-2026-48068\nCVE-2026-48801\nCVE-2026-59877\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"311ecff8-8324-3291-b7f2-d8b3178ab547","product":{"name":"registry.redhat.io/ansible-automation-platform/automation-portal@sha256:a85a548cb563a32be76c6e7e015fd57d340e068e321bf34b060d9eb901c33c4d_amd64","vendor":{"name":"Red Hat"}}},{"id":"31e60952-0a9a-3915-aadb-28544aea82d4","product":{"name":"Red Hat Ansible Automation Platform 2.1","vendor":{"name":"Red Hat"}}},{"id":"860f696f-a4de-3063-8cce-cf79cc54207b","product":{"name":"Self-service automation portal 2.1","vendor":{"name":"Red Hat"}}}]}}]}