PT-2026-38392 · Npm · Vm2

Kodove · Published 2026-05-01 · Updated 2026-06-04 · CVE-2026-44001

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0

Description A sandbox escape allows sandboxed code to crash the host Node.js process. This occurs when a Promise constructor triggers an unhandled rejection that propagates to the host. Specifically, when sandboxed code creates a Promise where the executor sets Error.name to a Symbol() and then accesses .stack, V8's internal FormatStackTrace attempts Symbol.toString(), throwing a host-realm TypeError. Because the Promise executor is not wrapped in a try-catch block in lib/setup-sandbox.js, and the .then() and .catch() overrides do not intercept rejections originating from the executor, the error becomes an unhandled rejection that terminates the host process. This results in a Denial of Service (DoS) where a single request can crash the entire server. Setting allowAsync: false does not prevent this and may exacerbate the issue by blocking .catch() method calls, ensuring the rejection remains unhandled.

Recommendations Update to version 3.11.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-248

Related Identifiers

BDU:2026-06909

CVE-2026-44001

GHSA-HW58-P9XV-2MJH

Affected Products

Vm2

References · 9

• 🔥 https://github.com/patriksimek/vm2/security/advisories/GHSA-hw58-p9xv-2mjh · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44001 · Security Note
• https://bdu.fstec.ru/vul/2026-06909 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44001 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hw58-p9xv-2mjh · Vendor Advisory
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/releases/tag/v3.11.0 · Note
• https://github.com/advisories/GHSA-99p7-6v5w-7xg8 · Note
• https://twitter.com/DFIR_Lab/status/2059788073689354532 · Twitter Post