CVE-2026-45411: RCE in vm2 Node.js Sandbox
Plattform
nodejs
Komponente
vm2
Behoben in
3.11.3
CVE-2026-45411 affects the vm2 Node.js sandbox, a tool used to isolate code execution. This vulnerability allows attackers to escape the sandbox and execute arbitrary commands on the host system, potentially leading to complete system compromise. Versions 0.0.0 through 3.11.2 are vulnerable, and a fix is available in version 3.11.3.
Auswirkungen und Angriffsszenarien
The impact of CVE-2026-45411 is severe. Successful exploitation allows an attacker to bypass the intended isolation provided by the vm2 sandbox. This means they can execute arbitrary code with the privileges of the Node.js process, potentially gaining access to sensitive data, modifying system configurations, or installing malware. The ability to execute arbitrary commands effectively grants the attacker full control over the host system. This vulnerability shares similarities with sandbox escape vulnerabilities where improper exception handling leads to code execution outside the intended boundaries.
Ausnutzungskontext
CVE-2026-45411 was published on 2026-05-13. Its severity is rated CRITICAL with a CVSS score of 9.8. Public proof-of-concept (POC) code is likely to emerge given the ease of exploitation and the critical nature of the vulnerability. The vulnerability is not currently listed on KEV or EPSS, but the high CVSS score suggests a medium to high probability of exploitation if a readily available POC is published.
Bedrohungsanalyse
Exploit-Status
CISA SSVC
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Netzwerk — aus der Ferne über das Internet ausnutzbar. Kein physischer oder lokaler Zugriff erforderlich.
- Attack Complexity
- Niedrig — keine besonderen Bedingungen erforderlich. Zuverlässig ausnutzbar.
- Privileges Required
- Keine — ohne Authentifizierung ausnutzbar. Keine Zugangsdaten erforderlich.
- User Interaction
- Keine — automatischer und lautloser Angriff. Das Opfer tut nichts.
- Scope
- Unverändert — Auswirkung auf das anfällige Komponente beschränkt.
- Confidentiality
- Hoch — vollständiger Vertraulichkeitsverlust. Angreifer kann alle Daten lesen.
- Integrity
- Hoch — Angreifer kann beliebige Daten schreiben, ändern oder löschen.
- Availability
- Hoch — vollständiger Absturz oder Ressourcenerschöpfung. Totaler Denial of Service.
Betroffene Software
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Reserviert
- Veröffentlicht
Mitigation und Workarounds
The primary mitigation for CVE-2026-45411 is to upgrade to vm2 version 3.11.3 or later. If an immediate upgrade is not possible due to compatibility issues or breaking changes, consider implementing runtime checks to prevent the use of yield* expressions within async generators inside the sandbox. While not a complete solution, this can reduce the attack surface. Monitor Node.js process logs for unusual activity or error messages related to the vm2 sandbox. After upgrading, confirm the fix by attempting to trigger the vulnerability with a crafted payload and verifying that the sandbox remains intact.
So behebenwird übersetzt…
Actualice a la versión 3.11.3 o superior para mitigar la vulnerabilidad. Esta versión corrige el problema al manejar correctamente las excepciones dentro de los generadores asíncronos, evitando la posibilidad de escape del sandbox.
Häufig gestellte Fragen
What is CVE-2026-45411 — RCE in vm2 Node.js Sandbox?
CVE-2026-45411 is a critical remote code execution (RCE) vulnerability in the vm2 Node.js sandbox. It allows attackers to escape the sandbox and execute arbitrary commands on the host system.
Am I affected by CVE-2026-45411 in vm2?
You are affected if you are using vm2 versions 0.0.0 through 3.11.2. Check your project dependencies to determine if you are vulnerable.
How do I fix CVE-2026-45411 in vm2?
Upgrade to vm2 version 3.11.3 or later. If an upgrade is not immediately possible, consider runtime checks to restrict the use of yield* expressions.
Is CVE-2026-45411 being actively exploited?
While there are no confirmed active campaigns currently, the high CVSS score and potential for easy exploitation suggest a high likelihood of exploitation if a public POC is released.
Where can I find the official vm2 advisory for CVE-2026-45411?
Refer to the vm2 project's GitHub repository and associated security advisories for the latest information: [https://github.com/vm2-io/vm2](https://github.com/vm2-io/vm2)
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Jetzt testen — kein Konto
Laden Sie ein Manifest hoch (composer.lock, package-lock.json, WordPress Plugin-Liste…) oder fügen Sie Ihre Komponentenliste ein. Sie erhalten sofort einen Schwachstellenbericht. Das Hochladen einer Datei ist nur der Anfang: Mit einem Konto erhalten Sie kontinuierliche Überwachung, Slack/email-Benachrichtigungen, Multi-Projekt- und White-Label-Berichte.
Abhängigkeitsdatei hier ablegen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...