CVE-2026-44003: VM2 Project VM2

Medium severity, CVSS 5.8. EPSS: 0.4% chance of exploitation in the next 30 days.

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performance optimization that skips AST analysis when the code does not contain catch, import, or async keywords. This fast-path bypass allows sandboxed code to directly access the internal VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL variable, which exposes internal security functions (handleException, wrapWith, import). This vulnerability is fixed in 3.11.0.

Affected products

• VM2 Project VM2: before 3.11.0 (fixed in 3.11.0)

Published 2026-05-13. Last modified 2026-06-17.