{"id":"EUVD-2026-30075","revision":"69ac89fd6ff645828cdec10dd0da1edf","records":[{"revision":"69ac89fd6ff645828cdec10dd0da1edf","observedAt":"2026-10-30T07:01:01.296+00:00","statement":{"source":"euvd","id":"EUVD-2026-30075","aliases":["CVE-2026-44005","GHSA-vwrp-x96c-mhwq"],"title":"vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and o…","description":"vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fixed in 3.11.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","score":10,"severity":null}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30075","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 13, 2026, 5:40:41 PM","dateUpdated":"Sep 7, 2026, 12:04:59 PM"},"relatedAdvisories":[{"id":"RHSA-2026:50850","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update","vulnerabilityIds":["CVE-2026-9277","CVE-2026-43997","CVE-2026-43998","CVE-2026-43999","CVE-2026-44000","CVE-2026-44001","CVE-2026-44002","CVE-2026-44003","CVE-2026-44004","CVE-2026-44005","CVE-2026-44006","CVE-2026-44007","CVE-2026-44008","CVE-2026-44009","CVE-2026-45411","CVE-2026-47131","CVE-2026-47135","CVE-2026-47137","CVE-2026-47139","CVE-2026-47140","CVE-2026-47141","CVE-2026-47209","CVE-2026-48068","CVE-2026-48801","CVE-2026-59877"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-30075","identifiers":["EUVD-2026-30075","CVE-2026-44005","GHSA-vwrp-x96c-mhwq"]},"retained":false,"historicalAffected":[]}],"coverage":[]}