CVE-2026-45411

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield* iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.3.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24	Exploit Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:50850
https://access.redhat.com/security/cve/CVE-2026-45411
https://bugzilla.redhat.com/show_bug.cgi?id=2477210
https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24	Exploit Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45411.json

Configurations

Configuration 1 (hide)

cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) vm2 es un vm/sandbox de código abierto para Node.js. Anteriormente a la 3.11.3, es posible capturar una excepción del host utilizando la expresión yield dentro de un generador asíncrono. Cuando el generador se cierra utilizando la función return, se espera el valor y las excepciones lanzadas en la llamada then serán capturadas por el entorno de ejecución y pasadas al iterador yield como el siguiente valor. Esto permite a los atacantes escribir código que puede escapar de la sandbox de VM2 y ejecutar comandos arbitrarios en el sistema host. Esta vulnerabilidad está corregida en la 3.11.3.

Information

Published : 2026-05-13 18:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-45411

Mitre link : CVE-2026-45411

CVE.ORG link : CVE-2026-45411

JSON object : View

Products Affected

vm2_project

vm2

CWE

CWE-668

Exposure of Resource to Wrong Sphere

CWE-237

Improper Handling of Structural Elements

{"id": "CVE-2026-45411", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45411", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-14T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "patriksimek", "product": "vm2", "versions": [{"status": "affected", "version": "< 3.11.3"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:ansible_portal:2.1"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.1", "versions": [{"status": "unaffected", "version": "1785854226", "lessThan": "*", "versionType": "rpm"}], "packageName": "ansible-automation-platform/automation-portal", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhdh:1"], "vendor": "Red Hat", "product": "Red Hat Developer Hub", "packageName": "rhdh/rhdh-hub-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-05-13T18:16:19.427", "references": [{"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:50850", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-45411", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477210", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45411.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-668"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-237"}]}], "descriptions": [{"lang": "en", "value": "vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield* iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.3."}, {"lang": "es", "value": "vm2 es un vm/sandbox de c\u00f3digo abierto para Node.js. Anteriormente a la 3.11.3, es posible capturar una excepci\u00f3n del host utilizando la expresi\u00f3n yield dentro de un generador as\u00edncrono. Cuando el generador se cierra utilizando la funci\u00f3n return, se espera el valor y las excepciones lanzadas en la llamada then ser\u00e1n capturadas por el entorno de ejecuci\u00f3n y pasadas al iterador yield como el siguiente valor. Esto permite a los atacantes escribir c\u00f3digo que puede escapar de la sandbox de VM2 y ejecutar comandos arbitrarios en el sistema host. Esta vulnerabilidad est\u00e1 corregida en la 3.11.3."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "0982ADA2-0F19-4E1B-AA4B-F13CA0885D1E", "versionEndExcluding": "3.11.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}