PT-2026-38394 · Npm · Vm2

Kodove · Published 2026-05-07 · Updated 2026-06-04 · CVE-2026-44003

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0

Description A performance optimization in the code transformer skips AST (Abstract Syntax Tree) analysis when the code does not contain the keywords catch, import, or async. This fast-path bypass allows sandboxed code to directly access the internal VM2 INTERNAL STATE DO NOT USE OR PROGRAM WILL FAIL variable, exposing internal security functions including handleException(), wrapWith(), and import(). This occurs because the AST visitor designed to block access to the internal state and the instrumentation for with statements are bypassed when the regex check is not triggered.

Recommendations Update to version 3.11.0.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2026-44003

GHSA-WP5R-2GW5-M7Q7

Affected Products

Vm2

References · 7

• 🔥 https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 · Exploit
• https://osv.dev/vulnerability/GHSA-wp5r-2gw5-m7q7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44003 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44003 · Vendor Advisory
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/releases/tag/v3.11.0 · Note
• https://reddit.com/r/VulnMatter/comments/1t691c5/resumen_diario_de_vulnerabilidades_07052026 · Reddit Post