CVE-2026-43997Critical· 10.0▾ Midnightvm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 55 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.0%
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.
vm2 < 3.11.0Upgrade past the affected range:
vm2 3.11.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44005Critical· 10.0vm2 is an open source vm/sandbox for Node.js
CVE-2026-44009Critical· 9.8vm2 is an open source vm/sandbox for Node.js
CVE-2026-44006Critical· 10.0vm2 is an open source vm/sandbox for Node.js
CVE-2026-24781Critical· 9.8vm2 is an open source vm/sandbox for Node.js
CVE-2026-93603Critical· 10.0vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code calls a host-provided non-strict (sloppy-mode) function without a receiver — e.…
CVE-2026-92937Critical· 10.0vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process