CVE-2026-44002

{
  "id": "CVE-2026-44002",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-13T18:16:16.857",
  "lastModified": "2026-10-26T17:10:03.270",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server. This vulnerability is fixed in 3.11.0."
    },
    {
      "lang": "es",
      "value": "vm2 es un vm/sandbox de código abierto para Node.js. Anterior a la 3.11.0, la clase envoltorio CallSite de vm2 (concebida como un envoltorio seguro para el CallSite nativo de V8) bloquea getThis() y getFunction() para evitar la fuga de objetos del host, pero permite que getFileName() devuelva rutas absolutas del host sin sanitizar. Cualquier código en sandbox puede extraer la estructura completa de directorios, las rutas de biblioteca y las versiones de framework del servidor host. Esta vulnerabilidad está corregida en la 3.11.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "patriksimek",
          "product": "vm2",
          "versions": [
            {
              "version": "< 3.11.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
          "baseScore": 5.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T18:23:24.071461Z",
          "id": "CVE-2026-44002",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-209"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "3.11.0",
              "matchCriteriaId": "6DD48308-6219-4C66-9BE7-246EE56FB834"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-v27g-jcqj-v8rw",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}