Skip to content
OpenAdvisories
Critical WID-SEC-2026-1349 16 CVEs

vm2: Mehrere Schwachstellen

Published May 3, 2026 · Updated Sep 17, 2026 · Revision 8 · de-DE

Vendor: Oracle Vendor: Red Hat Product: Enterprise Linux Product: Linux Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.

Product

vm2 ist eine Sandbox, in der nicht vertrauenswürdiger Code der in Node integrierten Module ausgeführt werden kann.

Vulnerabilities 16

  • Critical 10.0
    CVE-2026-43997

    vm2: Sandbox Escape

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.…

    patriksimek vm2 vm2 npm
  • Critical 10.0
    CVE-2026-44005

    vm2: Sandbox escape

    vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefinePr…

    patriksimek vm2 vm2 npm
  • Critical 10.0
    CVE-2026-44006

    vm2: Sandbox Escape

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

    patriksimek vm2 vm2 npm
  • Critical 9.9
    CVE-2026-43999

    vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes Node's Module._load(), which loads any module by name dir…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2026-22709

    vm2 has a Sandbox Escape

    vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2026-24118 Public exploit

    VM2 Sandbox Breakout Through __lookupGetter__

    vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue h…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2026-24120

    vm2: Sandbox Breakout Through Promise Species

    vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2026-24781

    vm2: Sandbox Breakout Through Inspect

    vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on …

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2026-26332

    vm2: Sandbox Escape

    vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2026-26956

    vm2: WASM Sandbox Escape (Node 25 only)

    vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation. This issue ha…

    patriksimek vm2 vm2 npm
  • Critical 9.1
    CVE-2026-44007

    vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the …

    patriksimek vm2 vm2 npm
  • High 8.6
    CVE-2026-44001

    vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the h…

    patriksimek vm2 vm2 npm
  • Medium 6.5
    CVE-2026-44000

    vm2: sandbox boundary bypass via host Promise resolution preserving host object identity

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the…

    patriksimek vm2 vm2 npm
  • Medium 5.8
    CVE-2026-44002

    vm2: Host File Path Disclosure via Stack Trace Information Leak

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized…

    patriksimek vm2 vm2 npm
  • Medium 5.3
    CVE-2026-44003

    vm2: Transformer Fast-Path Bypass Exposes Internal State Variable

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performance optimization that skips AST analysis when the code does not contain catch, import, or async keywords. This fast-path bypass allows sandboxed code to direct…

    patriksimek vm2 vm2 npm
  • Medium 5.3
    CVE-2026-92963

    vm2 before 3.11.2 Information Disclosure via Internal State

    vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.

    patriksimek vm2 vm2 npm

Revision history

  1. #8

    Referenz(en) aufgenommen: CVE-2026-92963, EUVD-2026-81613

  2. #7

    Neue Updates von Red Hat aufgenommen

  3. #6

    Neue Updates von Red Hat aufgenommen

  4. #5

    Neue Updates von Oracle Linux aufgenommen

  5. #4

    Referenz(en) aufgenommen: EUVD-2026-30071, EUVD-2026-30079, EUVD-2026-30074, EUVD-2026-30073, EUVD-2026-30067, EUVD-2026-30076, EUVD-2026-30077, EUVD-2026-30075, EUVD-2026-30072, EUVD-2026-30069, EUVD-2026-30070, EUVD-2026-30078

  6. #3

    CVE's ergänzt

  7. #2

    Referenz(en) aufgenommen: EUVD-2026-26995, EUVD-2026-26993, EUVD-2026-26987, EUVD-2026-26984, EUVD-2026-26986

  8. #1

    Initiale Fassung

References