CVE-2026-44002

🔶 medium

Summary

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server. This vulnerability is fixed in 3.11.0.

CVSS Score

5.8

Medium

EPSS Score

0.0

Exploit Probability

Published Date

2026-05-13

First Seen: 2026-05-17

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 32.9% of all 328,009 vulnerabilities in our database.

#220,040

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 14, 2026

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-05-14

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

CWE IDs (Weakness Types)

CWE-209

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
vm2_project	vm2	Affected	< 3.11.0

🔗 References 1

https://github.com/patriksimek/vm2/security/advisori...

Exploit Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-43997	⛔ critical	10.0	0.1	vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are vario...	2026-05-13
CVE-2026-43998	⚠️ high	8.5	0.3	vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using fi...	2026-05-13
CVE-2026-43999	⛔ critical	9.9	0.2	vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the modul...	2026-05-13
CVE-2026-44000	🔶 medium	6.5	0.0	vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object id...	2026-05-13
CVE-2026-44001	⚠️ high	8.6	0.1	vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any ...	2026-05-13
CVE-2026-44003	🔶 medium	5.3	0.0	vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performance optimization tha...	2026-05-13

These CVEs affect the same products