CVE-2026-44007
EUVD-2026-3007713.05.2026, 18:16
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised. This vulnerability is fixed in 3.11.1.EnginsightAffected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| vm2_project | vm2 | 𝑥 < 3.11.1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.1 | 1785854226 ≤ 𝑥 < * | ADP |
Common Weakness Enumeration
- CWE-284 - Improper Access ControlThe software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-1100 - Insufficient Isolation of System-Dependent FunctionsThe product or code does not isolate system-dependent functionality into separate standalone modules.
References