PT-2026-40731 · Npm · Vm2

Xmiliah · CVE-2026-45411 · Published 2026-05-13 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.3

Description A sandbox breakout allows attackers to execute arbitrary commands on the host system. This occurs because a host exception can be caught using the yield* expression within an async generator. When the generator is closed via the return function, the value is awaited, and exceptions thrown in the then call are caught by the runtime and passed to the yield* iterator as the next value.

Recommendations Update to version 3.11.3.

Exploit

Fix

RCE

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

CWE-237

Related Identifiers

BDU:2026-07028

CVE-2026-45411

ECHO-272E-9F96-27F5

GHSA-248R-7H7Q-CR24

Affected Products

Vm2

References · 16

• 🔥 https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45411.json · Exploit
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-45411 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07028 · Security Note
• https://osv.dev/vulnerability/GHSA-248r-7h7q-cr24 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45411 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45411 · Vendor Advisory
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/releases/tag/v3.11.3 · Note
• https://github.com/patriksimek/vm2/commit/093494c0c3ef2390d2e56909f9d56e290e6f18b0 · Note
• https://t.me/cveNotify/180217 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2477210 · Note
• https://twitter.com/jelizor/status/2059202279341768816 · Twitter Post
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45411.json · Note
• https://access.redhat.com/security/cve/CVE-2026-45411 · Note