Vulnerability in Patriksimek Vm2

CVE-2026-44008

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host Function object. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.009 (59.0th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 59.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-44008: held from 0.009 to 0.009.

EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: +0.001

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-44008?
CVE-2026-44008 is a critical-severity vulnerability in Patriksimek Vm2, classified under Exposure of Resource to Wrong Sphere. CVSS score: 9.8/10. Published 2026-05-13.
How severe is CVE-2026-44008?
Critical severity. CVSS v3 base score is 9.8 out of 10.