CVE-2026-44000

CVE-2026-44000 is a medium-severity vulnerability in Vm2 Project Vm2 with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-693.

Key facts

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the sandbox .then() callback preserves host identity. This allows the sandbox to interact with the host object directly, including performing identity checks using host-side WeakMap and mutating host object state from inside the sandbox. This behavior occurs because the Promise fulfillment wrapper uses ensureThis() instead of the stronger cross-realm conversion path (from() / proxy wrapping). If no prototype mapping is found, ensureThis() returns the original object. As a result, objects resolved by host Promises can cross the sandbox boundary without proper isolation. This vulnerability is fixed in 3.11.0.

Frequently asked questions

What is CVE-2026-44000?
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the sandbox .then() callback preserves host identity. This allows the sandbox to interact with the host object directly, including performing identity checks using host-side WeakMap and mutating host object state from inside the sandbox. This behavior occurs because the Promise fulfillment wrapper uses ensureThis() instead of the stronger cross-realm conversion path (from() / proxy wrapping). If no prototype mapping is found, ensureThis() returns the original object. As a result, objects resolved by host Promises can cross the sandbox boundary without proper isolation. This vulnerability is fixed in 3.11.0.
How severe is CVE-2026-44000?
CVE-2026-44000 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-44000 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-44000?
CVE-2026-44000 affects Vm2 Project Vm2. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-44000?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-44000 have an EU (EUVD) identifier?
Yes. CVE-2026-44000 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-30070.
When was CVE-2026-44000 published?
CVE-2026-44000 was published on 2026-05-13 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Vm2 Project Vm2

All CVEs affecting Vm2 Project Vm2 →

Other CWE-693 (Protection Mechanism Failure) vulnerabilities

Browse all CWE-693 (Protection Mechanism Failure) vulnerabilities →