vm2 CVE-2026-44006

Exploitation requires the target application to execute attacker-controlled JavaScript code within a vm2 sandbox instance running on Node.js. No special vm2 configuration is required - default sandbox settings are vulnerable. The attack works against vm2's standard VM and NodeVM modes. Specific Node.js built-in modules (Buffer, util, WebAssembly) must be accessible, which is true in default vm2 configurations. Attack succeeds remotely over network if the application accepts untrusted code input via HTTP APIs, WebSocket connections, or stored user scripts. No authentication or user interaction needed beyond the ability to submit JavaScript for execution. The vendor-provided PoC demonstrates the exploit works in standard vm2 deployments without requiring non-default settings or obscure deployment configurations.

Critical real-world risk confirmed across all signals. CVSS 10.0 (maximum severity) with network attack vector, no authentication, no user interaction, and scope change reflecting full sandbox escape. Vendor-published proof-of-concept demonstrates complete compromise chain from crafted JavaScript to arbitrary shell command execution. Fixed in coordinated security release addressing 13 sandbox escape vulnerabilities simultaneously, indicating vm2's sandboxing model had systemic weaknesses. No EPSS or KEV data provided, but public PoC in vendor advisory guarantees reproduction capability. Any deployment running untrusted JavaScript code in vm2 <=3.10.5 faces immediate RCE risk - vendor explicitly states 'embedders running untrusted code should upgrade.' Attack complexity is low despite sophisticated exploit chain because PoC provides turnkey weaponization. This represents complete failure of security boundary.

An attacker submits malicious JavaScript code to a web application that evaluates user input using vm2 for sandboxing (common in code playgrounds, serverless functions, or plugin systems). The attacker's payload creates crafted objects mimicking Buffer methods and passes a malicious stylize callback to trigger util.inspect processing. This leaks the BaseHandler, allowing prototype chain traversal to obtain host-realm constructors. The attacker then crafts an object with symbol-keyed properties that execute when WebAssembly.compileStreaming inspects it, invoking child_process.execSync to run arbitrary shell commands with the privileges of the Node.js process. The attacker achieves full server compromise, data exfiltration, or lateral movement within the infrastructure.