Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-44005: vm2: Attackers can modify fundamental JavaScript objects

GHSA-vwrp-x96c-mhwq CVE-2026-44005 CVE-2026-44005

Summary

The vm2 software allows attackers to modify fundamental JavaScript objects like Object.prototype, Array.prototype, and Function.prototype. This could allow attackers to gain control of a system or steal sensitive information. To protect your system, ensure you're using the latest version of vm2 and consider implementing additional security measures to prevent sandbox escape attacks.

What to do

Update GitHub Actions vm2 to version 3.11.0.
Update vm2 to version 3.11.0.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	GitHub Actions	vm2	>= 3.9.6, <= 3.10.5 Fix: upgrade to 3.11.0
npm	–	vm2	>= 3.9.6, <= 3.10.5 Fix: upgrade to 3.11.0

Original title

vm2: Sandbox escape

Original description

vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fixed in 3.11.0.

ghsa CVSS3.1 10.0

Vulnerability type

CWE-94 Code Injection

CWE-1321 Prototype Pollution

Published: 13 May 2026 · Updated: 20 Jul 2026 · First seen: 7 May 2026