Loading vulnerability…
vm2 handleException Null-Prototype Exception Sandbox Escape
CVE-2026-44009 is a sandbox escape vulnerability in the handleException function of vm2, a JavaScript sandbox library for Node.js. It affects versions prior to 3.11.2. A null-prototype exception can bypass exception-handling isolation, exposing host-side objects and enabling access to the host Function constructor. Successful exploitation permits arbitrary command execution on the underlying host. Version 3.11.2 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation breaks vm2's isolation boundary and allows attacker-controlled sandboxed JavaScript to execute arbitrary code or operating system commands on the host. Host-side objects and the host Function constructor can become accessible from the sandbox. The resulting access is bounded by the privileges of the hosting Node.js process; escalation beyond those privileges is not established.
If you can’t patch tonight, do this now.
For environments executing untrusted JavaScript, consider replacing reliance on vm2's JavaScript-only isolation with stronger isolation such as gVisor or Firecracker microVMs. This is defense in depth, not a substitute for installing the fixed version.
Patch, then assume compromise.
Upgrade upstream vm2 to version 3.11.2 or later. For Echo-packaged installations, the distribution-specific remediation identifies version 3.11.0+echo.1 or later as fixed. Upgrading only to upstream version 3.11.1 does not address this vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.