CVE-2026-44006

EUVD-2026-30076
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
10 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
Affected Products (NVD)
VendorProductVersion
vm2_projectvm2
𝑥
< 3.11.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8
https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8