9.8 Critical

CVE-2026-44009 vm2: Sandbox Breakout Through Null Proto Exception

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
vm2 3.11	earliest → < 3.11.2	3.11.2
Self-service automation portal 2	Versions not published
Red Hat Developer Hub	Versions not published
Red Hat Ansible Automation Platform 2.1 1785854226	earliest → < 1785854226	1785854226
Self-service automation portal 2.1 1785854226	earliest → < 1785854226	1785854226

References

github.com github.com
github.com github.com
access.redhat.com access.redhat.com
access.redhat.com access.redhat.com
bugzilla.redhat.com bugzilla.redhat.com
github.com github.com
security.access.redhat.com security.access.redhat.com

Timeline

Published May 13, 2026
Last modified November 4, 2026

The 77 CVEs of vm2 →

CVE-2026-100723 vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength… 6.9 Medium CVE-2026-100722 vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap 8.9 High CVE-2026-100721 vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver 9.5 Critical CVE-2026-93606 vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM` 10.0 Critical

Track this CVE