Bug 2477202 (CVE-2026-44003) - CVE-2026-44003 vm2: vm2: Sandbox escape due to code transformer optimization bypass
Summary: CVE-2026-44003 vm2: vm2: Sandbox escape due to code transformer optimization ...
Keywords:
Status: NEW
Alias: CVE-2026-44003
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-13 18:02 UTC by OSIDB Bzimport
Modified: 2026-06-16 22:52 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-05-13 18:02:21 UTC 
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performance optimization that skips AST analysis when the code does not contain catch, import, or async keywords. This fast-path bypass allows sandboxed code to directly access the internal VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL variable, which exposes internal security functions (handleException, wrapWith, import). This vulnerability is fixed in 3.11.0.
Note You need to log in before you can comment on or make changes to this bug.