Dashboard / CVE-2026-44000

CVE-2026-44000

HIGH
MEDIUM Priority: 0.01 BB Relevance: 74/100
Published: 2026-05-13 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Changed
C: Low
I: Low
A: None

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the sandbox .then() callback preserves host identity. This allows the sandbox to interact with the host object directly, including performing identity checks using host-side WeakMap and mutating host object state from inside the sandbox. This behavior occurs because the Promise fulfillment wrapper uses ensureThis() instead of the stronger cross-realm conversion path (from() / proxy wrapping). If no prototype mapping is found, ensureThis() returns the original object. As a result, objects resolved by host Promises can cross the sandbox boundary without proper isolation. This vulnerability is fixed in 3.11.0.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
vm2_project vm2 < 3.11.0

References & Advisories (1)

Bug Bounty Relevance

74 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

7.2 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS — Exploitation Probability

0.20%
Raw Score 0.002000
Percentile 9.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00200
2026-10-28
0.00200

Intelligence Sources

nvd ref →

External Links