← Database

CVE-2026-44006

CRITICAL CVSS: 10.0 Published: 2026-05-13 Modified: 2026-08-06

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

Affected Platforms

Vm2 Project Vm2

Weakness Type

CWE-94, CWE-914

References