CVE-2026-44009: vm2 Node.js Sandbox RCE Vulnerability

CVE-2026-44009 Overview

CVE-2026-44009 affects vm2, an open source virtual machine and sandbox library for Node.js. The vulnerability exists in versions prior to 3.11.2 and stems from improper exposure of resources to the wrong control sphere [CWE-668]. Attackers can leverage this flaw to escape the sandbox boundary that vm2 is designed to enforce. The issue is fixed in vm2 version 3.11.2.

The vm2 library is widely used to execute untrusted JavaScript code in a controlled environment. A sandbox escape in this component allows attacker-controlled code to break out and run with host-level Node.js privileges.

Critical Impact

Remote attackers can execute arbitrary code on the host Node.js process by escaping the vm2 sandbox, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

• vm2 versions prior to 3.11.2
• Node.js applications embedding vulnerable vm2 builds
• Server-side JavaScript services that execute untrusted code via vm2

Discovery Timeline

• 2026-05-13 - CVE-2026-44009 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44009

Vulnerability Analysis

The vm2 library provides an isolated execution context intended to safely run untrusted JavaScript. CVE-2026-44009 breaks this isolation guarantee. The root weakness is classified as Exposure of Resource to Wrong Sphere [CWE-668], meaning that host objects or capabilities reachable from the sandbox can be reused to obtain references outside the sandbox boundary.

Once an attacker holds a reference to a host object, the attacker can pivot to the underlying Node.js runtime. This grants access to modules such as child_process, fs, and process. The vulnerability is reachable over the network because vm2 is commonly invoked by web services that accept user-supplied scripts or expressions.

Root Cause

The root cause is a control-sphere boundary failure in the sandbox proxying logic. Sandboxed code can obtain a reference to an object whose prototype chain or property descriptors resolve into the host realm. Subsequent property access on that reference executes in host context rather than sandbox context.

Attack Vector

An attacker submits crafted JavaScript to any endpoint that evaluates the input through vm2. The crafted script triggers the boundary failure, retrieves a host-realm function such as the host Function constructor, and uses it to construct arbitrary code outside the sandbox. No authentication or user interaction is required when the consuming application exposes script evaluation to anonymous users.

The vulnerability is described in prose rather than code because no verified public proof-of-concept is referenced in the advisory data. See the GitHub Security Advisory GHSA-9vg3-4rfj-wgcm for vendor technical details.

Detection Methods for CVE-2026-44009

Indicators of Compromise

• Node.js processes spawning unexpected child processes such as sh, bash, cmd.exe, or powershell.exe from services that embed vm2
• Outbound network connections from Node.js workers that normally only handle inbound script evaluation requests
• File system writes by the Node.js process to paths outside the application working directory
• Application logs showing vm2 evaluation errors immediately preceding suspicious process activity

Detection Strategies

• Inventory all Node.js applications and identify those that depend on vm2 below version 3.11.2 using npm ls vm2
• Monitor for process lineage anomalies where a Node.js parent spawns shell or scripting interpreters
• Alert on access to sensitive files such as /etc/passwd, SSH keys, or cloud credential files by Node.js workers
• Inspect HTTP request bodies to script-evaluation endpoints for known sandbox-escape gadget patterns referencing constructor, prototype, or host Function

Monitoring Recommendations

• Enable runtime command-line auditing on hosts running vm2-backed services and forward events to a central data lake
• Track network egress from script execution workers and baseline normal destinations
• Capture stack traces from vm2 evaluation failures to identify probing attempts before successful escape

How to Mitigate CVE-2026-44009

Immediate Actions Required

• Upgrade vm2 to version 3.11.2 or later across all Node.js applications
• Audit application dependency trees for transitive vm2 usage and update lockfiles
• Restrict network exposure of any endpoint that evaluates user-supplied scripts until patching is complete
• Rotate credentials accessible to Node.js workers if compromise is suspected

Patch Information

The maintainers fixed the vulnerability in vm2 3.11.2. Refer to the GitHub Security Advisory GHSA-9vg3-4rfj-wgcm for the official patch reference. Note that the vm2 project has been deprecated by its maintainer; consider migrating to a maintained alternative such as isolated-vm for long-term sandboxing needs.

Workarounds

• Disable user-controlled script evaluation features until the upgrade is deployed
• Run vm2-dependent services inside a dedicated container with no outbound network access and read-only file system
• Drop Linux capabilities and apply seccomp profiles to constrain the Node.js process if a sandbox escape occurs
• Place authentication and strict input allowlists in front of any script-evaluation endpoint

# Upgrade vm2 to the patched version
npm install vm2@3.11.2 --save
npm ls vm2
npm audit