vm2 CVE-2026-44005

Default vm2 VM or NodeVM configuration is vulnerable-no special features, non-default settings, or specific deployment modes required. The PoC demonstrates exploitation against a freshly instantiated VM instance with default options. Attack requires only the ability to execute attacker-controlled JavaScript within a vm2 sandbox, which is the core intended use case of the library. Specifically, the vulnerable bridge.js implementation exposes Buffer.apply by default, and the __lookupGetter__ method is available on all JavaScript objects, providing the prototype-walking primitive without requiring host-realm constructor access or special sandbox configuration. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, user interaction, or network-level prerequisites beyond reaching an endpoint that accepts untrusted code input for vm2 evaluation. Exploitation succeeds against any vm2 version 3.9.6-3.10.5 inclusive, regardless of underlying Node.js version, operating system, or hosting environment.

Critical real-world risk despite vm2 project discontinuation in 2023. CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) indicates perfect attack conditions: network-accessible, low complexity, no authentication, scope change enabling host system compromise. The CVSS vector is fully supported by technical details-attacker-controlled JavaScript in a default VM instance directly mutates host prototypes, escalating from sandbox to host-realm code execution. Publicly available exploit code exists (working PoC in the advisory demonstrates prototype pollution via Buffer.apply prototype walk), lowering exploitation barrier to script-kiddie level. vm2's use case-executing untrusted third-party code in serverless platforms, CI/CD pipelines, plugin systems, and code playgrounds-means vulnerable deployments expose critical infrastructure. The coordinated v3.11.0 release closing 13 advisories (several full RCE primitives) signals widespread design flaws beyond this single CVE. EPSS data not provided but would likely be moderate-to-high given public exploit, ease of exploitation, and vm2's historical npm download volume (~500k weekly pre-deprecation). No KEV listing at analysis time, likely because vm2 was officially deprecated before CISA evaluation. Real priority: URGENT for any remaining vm2 deployments; organizational risk assessment must identify all vm2 dependencies (direct and transitive) given the library's end-of-life status and availability of superior alternatives like isolated-vm.

An attacker submits malicious JavaScript to a web application using vm2 for server-side code evaluation (e.g., a cloud-based code playground, CI/CD pipeline script runner, or SaaS plugin system). The payload chains __lookupGetter__('__proto__') calls through the exposed Buffer.apply function to walk prototype chains from the sandbox realm to the host's Object.prototype, then uses ordinary property assignment to inject a malicious getter/setter or pollute shared properties. When host-realm code later accesses the polluted prototype chain, the attacker's injected properties execute with host privileges, achieving full sandbox escape and remote code execution on the underlying Node.js server. With publicly available PoC code, attackers require no specialized exploitation knowledge beyond basic JavaScript prototype manipulation skills.