CVE-2026-45411

vm2 project vm2

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-45411

Katalog CVE

CVSS 9.8 · Critical EPSS 0,90%

Kerentanan Exposure of Resource to Wrong Sphere pada vm2 project vm2. Skor CVSS 3.1 9.8 (Critical) menurut github.com.

Deskripsi (NVD)

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield* iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.3.

Rincian

Terbit di NVD
13 Mei 2026
Terakhir diubah
7 September 2026
Status NVD
Modified
CVSS 3.1
9.8 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-668: Exposure of Resource to Wrong Sphere
CWE-237: Improper Handling of Structural Elements
EPSS (30 hari)
0,90% peluang dieksploitasi; lebih tinggi dari 58,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
vm2 project vm2 Semua versi sebelum 3.11.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.