Code Injection in vm2 - CVE-2026-44006
Published: May 4, 2026
Vulnerability identifier: #VU129591
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44006
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of code generation in BaseHandler.getPrototypeOf in vm2/lib/bridge.js when processing crafted objects through util.inspect and WebAssembly.compileStreaming. A remote attacker can send specially crafted input to escape the sandbox and execute arbitrary code.
The issue can be triggered by reaching BaseHandler via util.inspect to obtain arbitrary prototypes.
Affected software
vm2
How to mitigate CVE-2026-44006
Install security update from vendor's website.
vm2 - update to 3.11.0