PT-2026-39191 · Npm · Vm2

Xmiliah · CVE-2026-44008 · Published 2026-05-08 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VM2 (affected versions not specified)

Description A sandbox breakout allows attackers to execute arbitrary commands on the host system. The issue occurs because the neutralizeArraySpeciesBatch() function interacts with objects from an external context and can trigger a getter on the array prototype, exposing host objects into the sandbox. This mechanism enables an attacker to obtain the host Function object and achieve remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-1100

CWE-668

Related Identifiers

BDU:2026-07027

CVE-2026-44008

ECHO-7225-874A-912C

GHSA-9QJ6-QJGG-37QQ

Affected Products

Vm2

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44008.json · Exploit
• https://github.com/patriksimek/vm2/security/advisories/GHSA-9qj6-qjgg-37qq · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07027 · Security Note
• https://osv.dev/vulnerability/CVE-2026-44008 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9qj6-qjgg-37qq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44008 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44008 · Vendor Advisory
• https://github.com/patriksimek/vm2/releases/tag/v3.11.2 · Note
• https://github.com/patriksimek/vm2 · Note
• https://access.redhat.com/security/cve/CVE-2026-44008 · Note
• https://twitter.com/lyrie_ai/status/2053887788072964173 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2059813235314831817 · Twitter Post
• https://t.me/cveNotify/180212 · Telegram Post
• https://twitter.com/dailycve/status/2052785790829109323 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2477201 · Note