CVE-2026-44009: vm2 Sandbox Breakout Vulnerability Leading to Remote Code Execution
Summary
CVE-2026-44009: vm2 has Sandbox Breakout Through Null Proto Exception. Affects vm2 versions < 3.11.2. Fixed in 3.11.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js package that provides a sandboxed environment for executing JavaScript code securely. It allows developers to run untrusted code without risking the host system's integrity. However, due to a flaw in its exception handling mechanism, vm2 is vulnerable to a sandbox breakout, enabling attackers to execute arbitrary commands on the host system.
Vulnerability Detail
The vulnerability arises from the way vm2 handles exceptions with a null prototype. When such exceptions are thrown, they can be misinterpreted as being proxied from the sandbox. This allows attackers to access both proxied and unproxied objects, ultimately leading to the ability to invoke the host's Function object. As a result, an attacker can execute arbitrary code on the host system, posing a significant security risk.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.2
This is the first release that contains the fix.
npm install vm2@3.11.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting the execution of untrusted code or implementing additional security measures to mitigate the risk. However, the best approach is to update to the patched version as soon as possible.
Conclusion
The vm2 package is vulnerable to a critical sandbox breakout issue that allows remote code execution. It is essential to update to version 3.11.2 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor your applications for vulnerabilities in real-time.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability allows attackers to execute arbitrary commands on the host system, which can lead to data breaches, system compromise, and other severe security incidents.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing your package-lock.json file.
If you cannot update the package right away, consider implementing additional security measures to limit the execution of untrusted code until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
