CVE-2026-44007 patriksimek CVE debrief

Who should care

Developers and administrators using vm2 in their Node.js applications should be aware of this vulnerability. Specifically, anyone running untrusted code inside a NodeVM with nesting: true is at risk. This includes developers of applications that use vm2 for sandboxing, as well as administrators who have deployed such applications.

Technical summary

The vulnerability exists in the vm2 module, a sandbox for Node.js. When a NodeVM is created with nesting: true, it allows sandbox code to bypass the outer VM's require configuration, including require: false. This enables the sandbox to require('vm2') and create a new inner NodeVM with unrestricted require settings. Consequently, the sandbox can execute arbitrary OS commands on the host system. The vulnerability has a CVSS score of 9.1 and is classified as CRITICAL. It is fixed in vm2 version 3.11.1.

Defensive priority

This vulnerability has a high defensive priority due to its critical severity and potential for exploitation. Immediate action is recommended to mitigate the risk.

Recommended defensive actions

• Update vm2 to version 3.11.1 or later
• Review and restrict the use of nesting: true in NodeVMs
• Implement additional security measures to monitor and limit the execution of untrusted code
• Conduct thorough inventory checks to identify and patch vulnerable applications
• Enhance monitoring and exception tracking to detect potential exploitation attempts

Evidence notes

The vulnerability is confirmed by the vendor and multiple sources, including the NVD and Red Hat security advisories. The CVE record and NVD detail provide comprehensive information about the vulnerability. Additional sources, such as the vm2 project and security mailing lists, offer further context and mitigation guidance.

Official resources