CVE-2026-44005 Security Details

CVE ID

CVE-2026-44005

CWE

CWE-1321

CWE-653

CWE-94

CVE Description

vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fixed in 3.11.0.

Published

May 7, 2026

CVSS Score & Severity

7.8High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H

EPSS Score

0.117%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

createBridge/BaseHandler/definePropertyDesc()

JSVulnerable params: 1

createBridge/BaseHandler/deleteProperty()

JSVulnerable params: 1

createBridge/BaseHandler/preventExtensions()

JSVulnerable params: 0

createBridge/BaseHandler/set()

JS

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · Advisory · GHSA-vwrp-x96c-mhwqTHIRD_PARTY