Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-gbh7-h2ek-hqgg
Vulnerability ID VCID-gbh7-h2ek-hqgg
Aliases CVE-2026-44005
GHSA-vwrp-x96c-mhwq
Summary vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fixed in 3.11.0.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2026-44005
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2026-44005
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-vwrp-x96c-mhwq
cvssv3.1 10.0 https://github.com/patriksimek/vm2
generic_textual CRITICAL https://github.com/patriksimek/vm2
cvssv3.1 10.0 https://github.com/patriksimek/vm2/releases/tag/v3.11.0
generic_textual CRITICAL https://github.com/patriksimek/vm2/releases/tag/v3.11.0
cvssv3.1 10 https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq
cvssv3.1 10.0 https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq
cvssv3.1_qr CRITICAL https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq
generic_textual CRITICAL https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq
ssvc Track* https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq
cvssv3.1 10.0 https://nvd.nist.gov/vuln/detail/CVE-2026-44005
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2026-44005
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-44005
https://github.com/patriksimek/vm2
https://nvd.nist.gov/vuln/detail/CVE-2026-44005
GHSA-vwrp-x96c-mhwq https://github.com/advisories/GHSA-vwrp-x96c-mhwq
GHSA-vwrp-x96c-mhwq https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H Found at https://github.com/patriksimek/vm2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H Found at https://github.com/patriksimek/vm2/releases/tag/v3.11.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H Found at https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H Found at https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-05-15T03:56:03Z/ Found at https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-44005
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.28574
EPSS Score 0.00108
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:42:36.149596+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/44xxx/CVE-2026-44005.json 38.6.0