PT-2026-38397 · Npm · Vm2

C0Rydoras · Published 2026-05-01 · Updated 2026-06-15 · CVE-2026-44006

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0

Description A sandbox escape allows unauthenticated attackers to execute arbitrary system commands (RCE) on the host. The issue occurs because BaseHandler.getPrototypeOf can be reached via util.inspect, enabling the retrieval of arbitrary prototypes. By manipulating object prototypes through internal bridge functions, an attacker can gain access to the host's process object.

Recommendations Update to version 3.11.0.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-06907

CVE-2026-44006

GHSA-QCP4-V2JJ-FJX8

Affected Products

Vm2

References · 13

• 🔥 https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8 · Exploit
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44006 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qcp4-v2jj-fjx8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06907 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44006 · Security Note
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/blob/408fc855f1cc1bbc2985b029465ee0e732ada433/lib/bridge.js#L655-L658 · Note
• https://github.com/patriksimek/vm2/releases/tag/v3.11.0 · Note
• https://twitter.com/UpwindMDR/status/2052393610545352955 · Twitter Post
• https://twitter.com/PurpleOps_io/status/2054781781623099603 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2059803167194308901 · Twitter Post
• https://twitter.com/Tank23x0/status/2066581504562729337 · Twitter Post
• https://thehackernews.com/2026/05/vm2-nodejs-library-vulnerabilities.html · Note