CVE-2026-44006

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

Score

CVSS 3.1 10.0 Critical

Status

Modified - security-advisories@github.com

Published

2026-05-13

Last modified

2026-10-26

Weaknesses

CWE-914, CWE-94

Affected products

• Vm2 (Patriksimek)
• Ansible Portal (Redhat)
• Rhdh (Redhat)
• Vm2 (Vm2 Project)

References

• https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8
• https://access.redhat.com/security/cve/CVE-2026-44006
• https://bugzilla.redhat.com/show_bug.cgi?id=2477200
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44006.json
• https://access.redhat.com/errata/RHSA-2026:50850