CVE-2026-44009

CriticalCVSS 9.8/10Last modified Nov 4, 2026

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-668 CWE-653

Affected software

Vendor	Product	Versions
patriksimek	vm2	< 3.11.2
Red Hat	Red Hat Ansible Automation Platform 2.1	—
Red Hat	Red Hat Developer Hub	—

References

Timeline

Published: May 13, 2026
Last modified: Nov 4, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-44015.4The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()CVE-2026-440107.1Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resol CVE-2026-440118.6Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in CVE-2026-440127.1Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by CVE-2026-440159.9Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forge CVE-2026-440168.2Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. FIn versions CVE-2026-440177.5Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.91 CVE-2026-440187.1Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 u CVE-2026-440198.1Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior CVE-2026-440207.5Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 u CVE-2026-440225.5Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.73.0 u CVE-2026-440238.6Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior