PT-2026-39191 · Npm · Vm2

Xmiliah · Published 2026-05-08 · Updated 2026-05-13 · CVE-2026-44008

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VM2 (affected versions not specified)

Description A sandbox breakout allows attackers to execute arbitrary commands on the host system. The issue occurs because the neutralizeArraySpeciesBatch() function interacts with objects from an external context and can trigger a getter on the array prototype, exposing host objects into the sandbox. This mechanism enables an attacker to obtain the host Function object and achieve remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2026-07027

CVE-2026-44008

GHSA-9QJ6-QJGG-37QQ

Affected Products

Vm2

References · 8

• https://github.com/patriksimek/vm2/security/advisories/GHSA-9qj6-qjgg-37qq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44008 · Security Note
• https://osv.dev/vulnerability/GHSA-9qj6-qjgg-37qq · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07027 · Security Note
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/releases/tag/v3.11.2 · Note
• https://twitter.com/dailycve/status/2052785790829109323 · Twitter Post
• https://twitter.com/lyrie_ai/status/2053887788072964173 · Twitter Post