CVE-2026-44003

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performance optimization that skips AST analysis when the code does not contain catch, import, or async keywords. This fast-path bypass allows sandboxed code to directly access the internal VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL variable, which exposes internal security functions (handleException, wrapWith, import). This vulnerability is fixed in 3.11.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7	Exploit Mitigation Vendor Advisory
https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) vm2 es un vm/sandbox de código abierto para Node.js. Antes de 3.11.0, el transformador de código de vm2 tiene una optimización de rendimiento que omite el análisis AST cuando el código no contiene las palabras clave catch, import o async. Este bypass de ruta rápida permite que el código en sandbox acceda directamente a la variable interna VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL, que expone funciones de seguridad internas (handleException, wrapWith, import). Esta vulnerabilidad está corregida en 3.11.0.

Information

Published : 2026-05-13 18:16

Updated : 2026-10-26 17:10

NVD link : CVE-2026-44003

Mitre link : CVE-2026-44003

CVE.ORG link : CVE-2026-44003

JSON object : View

Products Affected

vm2_project

vm2

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2026-44003", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44003", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T18:40:49.017308Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "patriksimek", "product": "vm2", "versions": [{"status": "affected", "version": "< 3.11.0"}]}]}], "published": "2026-05-13T18:16:16.997", "references": [{"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performance optimization that skips AST analysis when the code does not contain catch, import, or async keywords. This fast-path bypass allows sandboxed code to directly access the internal VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL variable, which exposes internal security functions (handleException, wrapWith, import). This vulnerability is fixed in 3.11.0."}, {"lang": "es", "value": "vm2 es un vm/sandbox de c\u00f3digo abierto para Node.js. Antes de 3.11.0, el transformador de c\u00f3digo de vm2 tiene una optimizaci\u00f3n de rendimiento que omite el an\u00e1lisis AST cuando el c\u00f3digo no contiene las palabras clave catch, import o async. Este bypass de ruta r\u00e1pida permite que el c\u00f3digo en sandbox acceda directamente a la variable interna VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL, que expone funciones de seguridad internas (handleException, wrapWith, import). Esta vulnerabilidad est\u00e1 corregida en 3.11.0."}], "lastModified": "2026-10-26T17:10:03.270", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "6DD48308-6219-4C66-9BE7-246EE56FB834", "versionEndExcluding": "3.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}