CVE-2026-44005

vm2 project vm2

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-44005

Katalog CVE

CVSS 10.0 · Critical EPSS 0,83%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada vm2 project vm2. Skor CVSS 3.1 10.0 (Critical) menurut github.com.

Deskripsi (NVD)

vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fixed in 3.11.0.

Rincian

Terbit di NVD
13 Mei 2026
Terakhir diubah
7 September 2026
Status NVD
Modified
CVSS 3.1
10.0 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-653: Improper Isolation or Compartmentalization
EPSS (30 hari)
0,83% peluang dieksploitasi; lebih tinggi dari 56,3% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
vm2 project vm2 Versi 3.9.6 hingga sebelum 3.11.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.