vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8 Exploit, Vendor Advisory
- https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 10.0 · vm2_projectNVD modified 2026-10-26 17:10
Affected (CPE criteria) 1
cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*
References 6
- https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8 Exploit, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:50850
- https://access.redhat.com/security/cve/CVE-2026-44006
- https://bugzilla.redhat.com/show_bug.cgi?id=2477200
- https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8 Exploit, Vendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44006.json