CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

vm2 improper access control sandbox escape (CVSS 9.1, fixed in vm2 3.11.1)

cve · CVE-2026-44007 single-source

Coverage
1
first 2026-05-20 → last 2026-10-21
Latest activity
2026-05-20
vm2 sandbox escapes let untrusted JavaScript run code on the host; the May 2026 flaws are all fixed only in…
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
7
4 hosts

Defender insights

What each entry about CVE-2026-44007 tells a defender to do, newest first.

2026-05-20NOTABLEvm2 sandbox escapes let untrusted JavaScript run code on the host; the May 2026 flaws are all fixed only in 3.11.4

Exposure · triage · detection

Story timeline

  1. 2026-05-20vm2 Node.js sandbox: two waves of critical sandbox escapes in May 2026, fixed in 3.11.2 and then 3.11.4
    trending-vulnerabilitiesvm2 sandbox escapes let untrusted JavaScript run code on the host; the May 2026 flaws are all fixed only in 3.11.4

Hunting pivots

Affected products
vm2
Tags
ai-abusepatch-availablepoc-publicpre-authrcesupply-chainvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter: JavaScript

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-20/vm2-node-js-sandbox-12-critical-cves-cve-2026-43997-43999-44 · ATT&CK page ↗

Execution TA0002

T1059.007Command and Scripting Interpreter: JavaScript×1

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

Evidence: 2026-05-20/vm2-node-js-sandbox-12-critical-cves-cve-2026-43997-43999-44 · ATT&CK page ↗

Entries about vm2 improper access control sandbox escape (CVSS 9.1, fixed in vm2 3.11.1) (1)

2026-05-20 · view entry permalink →

NOTABLECVE-2026-24118 +20updatedNATOA2

vm2 Node.js sandbox: two waves of critical sandbox escapes in May 2026, fixed in 3.11.2 and then 3.11.4

The Hacker News reported on 2026-05-07 a dozen critical vulnerabilities in vm2, the Node.js library that runs untrusted JavaScript in a sandbox by intercepting and proxying objects, which let an attacker break out and execute arbitrary code on the host; fixes landed across versions 3.10.5 to 3.11.2, and users were told to update to 3.11.2 (The Hacker News, 2026-05-07). Among them, CVE-2026-43997 (CVSS 10.0) obtains the host Object despite earlier protections (vm2 GHSA-47x8-96vw-5wg6), CVE-2026-44006 (10.0) reaches BaseHandler.getPrototypeOf to get arbitrary prototypes (vm2 GHSA-qcp4-v2jj-fjx8), and CVE-2026-43999 (9.9) bypasses NodeVM's builtin allowlist whenever the module builtin is allowed, including through the '*' wildcard, so sandboxed code can load excluded builtins such as child_process (vm2 GHSA-947f-4v7f-x2v8); CVE-2026-44008 escapes through neutralizeArraySpeciesBatch() and CVE-2026-44009 through a null-proto exception, both 9.8 and fixed in 3.11.2 (The Hacker News, 2026-05-07). On 2026-05-18 the maintainer published a second set of advisories affecting 3.11.3 and earlier and fixed in 3.11.4 (vm2 GHSA-v6mx-mf47-r5wg), covered by BSI's WID-SEC-2026-1583 with CVE-2026-47131, CVE-2026-47135, CVE-2026-47137, CVE-2026-47139, CVE-2026-47140, CVE-2026-47141, CVE-2026-47208, CVE-2026-47209 and CVE-2026-47210; BSI says a remote, anonymous attacker can use them to execute arbitrary code, bypass security measures and disclose confidential information (BSI WID-SEC-2026-1583). Kodem Security describes the wave as vulnerability research rather than campaign reporting (Kodem Security, 2026-05-14).

Triage: the discriminator is whether the Node.js runtime is expected to start shells at all: Kodem's indicator is a shell parented to a runtime that should not invoke one, or a child_process call traced to a sandboxed context (Kodem Security, 2026-05-14).

A dozen critical security vulnerabilities have been disclosed in the vm2 Node.js library that could be exploited by bad actors to break out of the sandbox and execute arbitrary code on susceptible systems.

The Hacker News 2026-05-07

NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard).

vm2 (GHSA-947f-4v7f-x2v8)

Untrusted JavaScript reaches vm2. In AI agent environments, the source is often LLM output produced in response to a manipulated prompt.

Kodem Security 2026-05-14
Correctionrun 2026-10-21T1148Z-auditaffected_productsbodyclassificationcvesevent_dateevidenceheadlinesectorssourcessourcing_notesummarytechniquestitleverification

The twelve critical vm2 CVEs were reported on 2026-05-07, with 3.11.2 as the version to update to (The Hacker News, 2026-05-07); BSI's WID-SEC-2026-1583 of 2026-05-18 covers a later, different set, CVE-2026-47131 and eight others, fixed in 3.11.4 (BSI WID-SEC-2026-1583). CVE-2026-43999 bypasses NodeVM's builtin allowlist when the module builtin is allowed, not when child_process is (vm2 GHSA-947f-4v7f-x2v8); CVE-2026-43997 obtains the host Object (vm2 GHSA-47x8-96vw-5wg6) while BaseHandler.getPrototypeOf is CVE-2026-44006 (vm2 GHSA-qcp4-v2jj-fjx8); and CVE-2026-44008 and CVE-2026-44009 are separate escapes, through neutralizeArraySpeciesBatch() and through a null-proto exception (The Hacker News, 2026-05-07). Kodem Security attributes the prompt-to-host-execution framing to Microsoft Security Research and gives no quoted chain (Kodem Security, 2026-05-14).

vulnerability20 May 05:00Zsingle-sourceOpen finding →
Sources: BSI WID-SEC-2026-1583 · The Hacker News · Kodem Security · vm2 (GHSA-47x8-96vw-5wg6) · vm2 (GHSA-947f-4v7f-x2v8) · vm2 (GHSA-qcp4-v2jj-fjx8) · vm2 (GHSA-v6mx-mf47-r5wg)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • github.com4 (57%)
  • kodemsecurity.com1 (14%)
  • thehackernews.com1 (14%)
  • wid.cert-bund.de1 (14%)

External references

NVD · cve.org · CISA KEV

All cited sources (7)