CVE-2026-44007Critical· 9.1▾ Midnightvm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. Wi…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.9%
0.9% → 1.0%
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised. This vulnerability is fixed in 3.11.1.
vm2 < 3.11.1Upgrade past the affected range:
vm2 3.11.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44008Critical· 9.8vm2 is an open source vm/sandbox for Node.js
CVE-2026-93604High· 7.2vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM (require.builtin: ['crypto'])
CVE-2026-92942High· 7.5vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call
CVE-2026-45411Critical· 9.8vm2 is an open source vm/sandbox for Node.js
CVE-2026-44009Critical· 9.8vm2 is an open source vm/sandbox for Node.js
CVE-2026-44006Critical· 10.0vm2 is an open source vm/sandbox for Node.js