CVE-2026-44006Critical· 10.0▾ Midnightvm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 55 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.8%
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.
vm2 < 3.11.0Upgrade past the affected range:
vm2 3.11.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44005Critical· 10.0vm2 is an open source vm/sandbox for Node.js
CVE-2026-43997Critical· 10.0vm2 is an open source vm/sandbox for Node.js
CVE-2026-93603Critical· 10.0vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code calls a host-provided non-strict (sloppy-mode) function without a receiver — e.…
CVE-2026-92937Critical· 10.0vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process
CVE-2026-45411Critical· 9.8vm2 is an open source vm/sandbox for Node.js
CVE-2026-44009Critical· 9.8vm2 is an open source vm/sandbox for Node.js