PT-2026-39192 · Npm · Vm2

Xmiliah · Published 2026-05-08 · Updated 2026-05-18 · CVE-2026-44009

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VM2 (affected versions not specified)

Description A sandbox breakout allows attackers to write code that escapes the VM2 sandbox to execute arbitrary commands on the host system. This occurs in the handleException() function where exceptions with a null prototype are assumed to be proxied from another side. By throwing and catching an object with a null prototype, an attacker can obtain both the proxied and unproxied versions of a sandbox object, enabling access to the host Function object and resulting in Remote Code Execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2026-06913

CVE-2026-44009

GHSA-9VG3-4RFJ-WGCM

Affected Products

Vm2

References · 9

• 🔥 https://github.com/patriksimek/vm2/security/advisories/GHSA-9vg3-4rfj-wgcm · Exploit
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44009 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9vg3-4rfj-wgcm · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06913 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44009 · Security Note
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/releases/tag/v3.11.2 · Note
• https://dailycve.com/vm2-sandbox-breakout-vulnerability-cve-2026-44009-critical · Note
• https://twitter.com/dailycve/status/2052799860676387275 · Twitter Post