vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host Function object. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch
    works with objects from the other side but can call into this side via getter on the array prototype
    exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host
    Function object. This allows attackers to write code which can escape from the VM2 sandbox and execute
    arbitrary commands on the host system. This vulnerability is fixed in 3.11.2. (CVE-2026-44008)

ID	Name	Product	Family	Type	Severity
465356	Echo: vm2: security update to 3.11.0+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	critical
465356	Echo: vm2: security update to 3.11.0+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
441541	SCA: security update for vm2 (GHSA-9qj6-qjgg-37qq)	Tenable Cloud Security	SCA Checks	Local	critical
441541	SCA: security update for vm2 (GHSA-9qj6-qjgg-37qq)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-44008

critical

Tenable Plugins

critical

critical

critical

critical