Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-598j-pe72-qkh3
Vulnerability ID VCID-598j-pe72-qkh3
Aliases CVE-2026-45411
GHSA-248r-7h7q-cr24
Summary vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield* iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.3.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-668 Exposure of Resource to Wrong Sphere
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2026-45411
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2026-45411
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2026-45411
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-248r-7h7q-cr24
cvssv3.1 9.8 https://github.com/patriksimek/vm2
generic_textual CRITICAL https://github.com/patriksimek/vm2
cvssv3.1 9.8 https://github.com/patriksimek/vm2/commit/093494c0c3ef2390d2e56909f9d56e290e6f18b0
generic_textual CRITICAL https://github.com/patriksimek/vm2/commit/093494c0c3ef2390d2e56909f9d56e290e6f18b0
cvssv3.1 9.8 https://github.com/patriksimek/vm2/releases/tag/v3.11.3
generic_textual CRITICAL https://github.com/patriksimek/vm2/releases/tag/v3.11.3
cvssv3.1 9.8 https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24
cvssv3.1_qr CRITICAL https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24
generic_textual CRITICAL https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24
ssvc Track* https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2026-45411
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2026-45411
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-45411
https://github.com/patriksimek/vm2
https://github.com/patriksimek/vm2/commit/093494c0c3ef2390d2e56909f9d56e290e6f18b0
https://github.com/patriksimek/vm2/releases/tag/v3.11.3
https://nvd.nist.gov/vuln/detail/CVE-2026-45411
GHSA-248r-7h7q-cr24 https://github.com/advisories/GHSA-248r-7h7q-cr24
GHSA-248r-7h7q-cr24 https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/patriksimek/vm2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/patriksimek/vm2/commit/093494c0c3ef2390d2e56909f9d56e290e6f18b0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/patriksimek/vm2/releases/tag/v3.11.3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-05-13T18:06:42Z/ Found at https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-45411
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.23987
EPSS Score 0.00082
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:44:02.002673+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/45xxx/CVE-2026-45411.json 38.6.0