{"id":"EUVD-2026-30079","enisaUuid":"724424e5-3eb2-3ba4-b1b9-bf196575d976","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2,  This vulnerability is fixed in 3.11.2.","datePublished":"May 13, 2026, 5:36:07 PM","dateUpdated":"Sep 7, 2026, 12:05:03 PM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-9vg3-4rfj-wgcm\n","aliases":"CVE-2026-44009\nGHSA-9vg3-4rfj-wgcm\n","assigner":"GitHub_M","epss":0.81,"enisaIdProduct":[{"id":"d6598e7b-4df0-3e23-815c-638561330d7d","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.2"}],"enisaIdVendor":[{"id":"d325d556-7fcb-3363-96df-476c609c1eb7","vendor":{"name":"patriksimek"}}],"enisaIdVulnerability":[{"id":"6a328ed6-2f2c-34d9-9a67-ae7549908fb5","vulnerability":{"id":"GHSA-9vg3-4rfj-wgcm","description":"vm2 has Sandbox Breakout Through Null Proto Exception","datePublished":"May 8, 2026, 4:20:58 PM","dateUpdated":"May 14, 2026, 8:37:12 PM","baseScore":0.0,"references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-9vg3-4rfj-wgcm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44009\nhttps://github.com/patriksimek/vm2\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.2\n","enisa_id":"EUVD-2026-30079\n","aliases":"GHSA-9vg3-4rfj-wgcm\nCVE-2026-44009\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fe0a8c29-c778-3e53-a55f-7b9994dcf534","vulnerability":{"id":"CVE-2026-44009","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2,  This vulnerability is fixed in 3.11.2.","datePublished":"May 13, 2026, 5:36:07 PM","dateUpdated":"Sep 7, 2026, 12:05:03 PM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-9vg3-4rfj-wgcm\n","enisa_id":"EUVD-2026-30079\n","assigner":"GitHub_M","epss":0.81,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"25a8e40b-695d-34ad-9907-434c70ba3079","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.2"}],"vulnerabilityVendor":[{"id":"5cf59f36-5324-3d22-8cb5-b5f408c9b5c9","vendor":{"name":"patriksimek"}}]}}],"enisaIdAdvisory":[{"id":"6f2cefe6-7c6b-383c-8fe4-31bfcb3a2207","advisory":{"id":"RHSA-2026:50850","description":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update","summary":"Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.","datePublished":"Aug 5, 2026, 4:35:19 PM","dateUpdated":"Oct 15, 2026, 11:26:24 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:50850\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50850.json\n","aliases":"CVE-2026-9277\nCVE-2026-43997\nCVE-2026-43998\nCVE-2026-43999\nCVE-2026-44000\nCVE-2026-44001\nCVE-2026-44002\nCVE-2026-44003\nCVE-2026-44004\nCVE-2026-44005\nCVE-2026-44006\nCVE-2026-44007\nCVE-2026-44008\nCVE-2026-44009\nCVE-2026-45411\nCVE-2026-47131\nCVE-2026-47135\nCVE-2026-47137\nCVE-2026-47139\nCVE-2026-47140\nCVE-2026-47141\nCVE-2026-47209\nCVE-2026-48068\nCVE-2026-48801\nCVE-2026-59877\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"311ecff8-8324-3291-b7f2-d8b3178ab547","product":{"name":"registry.redhat.io/ansible-automation-platform/automation-portal@sha256:a85a548cb563a32be76c6e7e015fd57d340e068e321bf34b060d9eb901c33c4d_amd64","vendor":{"name":"Red Hat"}}},{"id":"31e60952-0a9a-3915-aadb-28544aea82d4","product":{"name":"Red Hat Ansible Automation Platform 2.1","vendor":{"name":"Red Hat"}}},{"id":"860f696f-a4de-3063-8cce-cf79cc54207b","product":{"name":"Self-service automation portal 2.1","vendor":{"name":"Red Hat"}}}]}}]}