PT-2026-38391 · Npm · Vm2

Fasrm · Published 2026-05-07 · Updated 2026-06-04 · CVE-2026-44000

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0

Description A sandbox boundary violation allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the .then() callback preserves host identity. This occurs because the Promise fulfillment wrapper uses the ensureThis() function instead of a stronger cross-realm conversion path. If no prototype mapping is found, ensureThis() returns the original object, allowing the sandbox to interact with the host object directly. This enables performing identity checks using host-side WeakMap and mutating host object state from inside the sandbox.

Recommendations Update to version 3.11.0.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Protection Mechanism Failure

Weakness Enumeration

CWE-668

CWE-693

Related Identifiers

CVE-2026-44000

GHSA-MPF8-4HX2-7CJG

Affected Products

Vm2

References · 6

• 🔥 https://github.com/patriksimek/vm2/security/advisories/GHSA-mpf8-4hx2-7cjg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44000 · Security Note
• https://osv.dev/vulnerability/GHSA-mpf8-4hx2-7cjg · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44000 · Vendor Advisory
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/releases/tag/v3.11.0 · Note