CVE-2026-44003: Vm2_project Vm2 RCE Vulnerability

CVE-2026-44003 Overview

CVE-2026-44003 is a sandbox escape vulnerability in vm2, an open source virtual machine and sandbox library for Node.js. The flaw exists in vm2 versions prior to 3.11.0. The code transformer contains a performance optimization that skips Abstract Syntax Tree (AST) analysis when sandboxed code does not contain catch, import, or async keywords. Attackers can leverage this fast-path bypass to access the internal VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL variable. That variable exposes internal security functions including handleException, wrapWith, and import. The vulnerability is categorized under [CWE-693] (Protection Mechanism Failure) and is fixed in version 3.11.0.

Critical Impact
Sandboxed code can reach vm2 internal security functions, breaking the isolation boundary the library is designed to enforce.

Affected Products

vm2_projectvm2 versions prior to 3.11.0
Node.js applications embedding vm2 for untrusted code evaluation
Downstream packages that bundle vulnerable vm2 releases

Discovery Timeline

2026-05-13 - CVE-2026-44003 published to NVD
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-44003

Vulnerability Analysis

The vm2 library transforms guest code before evaluation to enforce sandbox boundaries. The transformer rewrites constructs that could be used to reach host objects, including try/catch handlers, dynamic import, and async functions. To reduce overhead, the transformer applies a fast-path check: if the source code does not contain the substrings catch, import, or async, full AST analysis is skipped.

This optimization assumes those keywords are the only paths to internal state. Guest code that avoids all three substrings is passed through without the protective rewrites. The unmodified guest can then reference VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL, an internal binding intended to be hidden from sandboxed scopes.

Once reachable, the internal state object exposes handleException, wrapWith, and import. These are the primitives the sandbox uses to marshal values across the host and guest boundary. Misusing them allows guest code to obtain host references and execute outside the sandbox.

Root Cause

The root cause is an unsafe optimization in the code transformer. A keyword-substring check is used as a proxy for whether full transformation is required. The check does not account for all syntactic paths to the internal state binding, which violates the protection mechanism the transformer is meant to provide.

Attack Vector

An attacker submits crafted JavaScript to any application that evaluates untrusted code using vm2 below 3.11.0. The payload omits the catch, import, and async substrings, triggering the fast path. The payload then references VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL and invokes the exposed internal functions to break out of the sandbox or manipulate host state. No authentication or user interaction is required when the application accepts guest scripts over the network.

No verified public exploit code is currently published. Refer to the GitHub Security Advisory GHSA-wp5r-2gw5-m7q7 for vendor technical detail.

Detection Methods for CVE-2026-44003

Indicators of Compromise

Guest scripts that reference the literal string VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL
Unexpected child processes or outbound network connections originating from Node.js workers that host vm2
Application logs showing exceptions inside vm2 internal functions such as handleException or wrapWith

Detection Strategies

Inventory all Node.js services and dependency trees for vm2 versions below 3.11.0 using npm ls vm2 or software composition analysis tooling.
Inspect guest code submissions for references to the internal state variable or property access patterns targeting handleException, wrapWith, or import on unexpected objects.
Monitor Node.js process telemetry for behavior inconsistent with sandboxed workloads, such as file system writes outside designated directories.

Monitoring Recommendations

Forward Node.js application and runtime logs to a centralized analytics platform and alert on stack frames referencing vm2 internals.
Track endpoint and container telemetry for the host running vm2 workers, focusing on process creation, network egress, and credential file access.
Add a content rule to web application firewalls to flag inbound script payloads containing VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL.

How to Mitigate CVE-2026-44003

Immediate Actions Required

Upgrade vm2 to version 3.11.0 or later in all production, staging, and build environments.
Audit applications that evaluate untrusted JavaScript and confirm none ship with a transitive vm2 dependency below 3.11.0.
Rotate any secrets accessible from processes that ran vulnerable vm2 instances exposed to untrusted input.

Patch Information

The maintainers fixed the issue in vm2 3.11.0 by removing the keyword fast-path so the AST transformer runs unconditionally. Update via npm install vm2@^3.11.0 or the equivalent yarn or pnpm command. Refer to the vm2 GitHub Security Advisory for upgrade guidance and full vendor detail.

Workarounds

If immediate upgrade is not possible, reject or pre-filter any guest script that contains the substring VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL before evaluation.
Isolate Node.js workers that run vm2 in a separate process, container, or seccomp-confined environment with minimal privileges and no outbound network access.
Consider migrating to a maintained alternative such as isolated-vm for untrusted code execution, since vm2 is no longer actively developed.

bash

# Configuration example
npm install vm2@^3.11.0
npm ls vm2