Pending AnalysisCVE-2026-45411

CVE-2026-45411: RCE in vm2 Node.js Sandbox

Platform

nodejs

Component

vm2

Fixed in

3.11.3

CVE-2026-45411 affects the vm2 Node.js sandbox, a tool used for creating isolated JavaScript environments. This vulnerability allows attackers to escape the sandbox and execute arbitrary commands on the host system, potentially leading to complete system compromise. The vulnerability impacts versions 0.0.0 up to and including 3.11.2. A fix is available in version 3.11.3.

Impact and Attack Scenarios

The impact of CVE-2026-45411 is severe. Successful exploitation allows an attacker to bypass the intended isolation of the vm2 sandbox and gain direct access to the host system. This could involve executing malicious code, stealing sensitive data, installing malware, or establishing persistent backdoors. The ability to execute arbitrary commands effectively grants the attacker complete control over the affected system. This vulnerability shares similarities with sandbox escape vulnerabilities where improper exception handling leads to privilege escalation and code execution outside the intended boundaries.

Exploitation Context

CVE-2026-45411 was published on 2026-05-13. Its severity is rated CRITICAL (CVSS 9.8). Exploitation context is currently limited, with no known active campaigns or widespread exploitation. Public proof-of-concept (POC) code is likely to emerge given the vulnerability's severity and ease of exploitation. It is not currently listed on KEV or EPSS, but the high CVSS score suggests a medium to high probability of exploitation if a POC is released.

Threat Intelligence

Exploit Status

Proof of ConceptUnknown
CISA KEVNO
Internet ExposureHigh

CISA SSVC

Exploitationpoc
Automatableyes
Technical Impacttotal

CVSS Vector

THREAT INTELLIGENCE· CVSS 3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H9.8CRITICALAttack VectorNetworkHow the attacker reaches the targetAttack ComplexityLowConditions required to exploitPrivileges RequiredNoneAuthentication level needed to attackUser InteractionNoneWhether a victim must take actionScopeUnchangedImpact beyond the vulnerable componentConfidentialityHighRisk of sensitive data exposureIntegrityHighRisk of unauthorized data modificationAvailabilityHighRisk of service disruptionnextguardhq.com · CVSS v3.1 Base Score
What do these metrics mean?
Attack Vector
Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
Attack Complexity
Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
Privileges Required
None — unauthenticated. No login or credentials needed to exploit.
User Interaction
None — attack is automatic and silent. Victim does nothing: no click, no file open.
Scope
Unchanged — impact is limited to the vulnerable component itself.
Confidentiality
High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
Integrity
High — attacker can write, modify, or delete any data: databases, config files, or code.
Availability
High — complete crash or resource exhaustion. Full denial of service.

Affected Software

Componentvm2
Vendorpatriksimek
Minimum version0.0.0
Maximum version< 3.11.3
Fixed in3.11.3

Weakness Classification (CWE)

Timeline

  1. Reserved
  2. Published

Mitigation and Workarounds

The primary mitigation for CVE-2026-45411 is to immediately upgrade to vm2 version 3.11.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by carefully reviewing and sanitizing any user-provided code executed within the vm2 sandbox. While not a complete solution, restricting the permissions of the process running vm2 can limit the potential damage. Monitor system logs for unusual activity or errors related to vm2, which could indicate exploitation attempts. After upgrading, confirm the fix by attempting to trigger the vulnerability with known exploit patterns and verifying that the sandbox remains intact.

How to fix

Actualice a la versión 3.11.3 o superior para mitigar la vulnerabilidad. Esta versión corrige el problema al manejar correctamente las excepciones dentro de los generadores asíncronos, evitando la posibilidad de escape del sandbox.

Frequently asked questions

What is CVE-2026-45411 — RCE in vm2 Node.js Sandbox?

CVE-2026-45411 is a critical Remote Code Execution (RCE) vulnerability in the vm2 Node.js sandbox, allowing attackers to escape the sandbox and execute arbitrary code on the host system. It affects versions 0.0.0 through 3.11.2.

Am I affected by CVE-2026-45411 in vm2?

Yes, if you are using vm2 versions 0.0.0 through 3.11.2, you are vulnerable to this RCE. Immediately check your installed version and upgrade if necessary.

How do I fix CVE-2026-45411 in vm2?

The recommended fix is to upgrade to vm2 version 3.11.3 or later. This version includes a patch that addresses the vulnerability. If immediate upgrade is not possible, consider temporary workarounds like code review and permission restrictions.

Is CVE-2026-45411 being actively exploited?

Currently, there are no confirmed reports of active exploitation. However, given the vulnerability's severity and potential impact, exploitation is likely if a public proof-of-concept is released.

Where can I find the official vm2 advisory for CVE-2026-45411?

Refer to the vm2 project's GitHub repository and associated security advisories for the latest information and updates regarding CVE-2026-45411: [https://github.com/vm2js/vm2](https://github.com/vm2js/vm2)

Is your project affected?

Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.

livefree scan

Try it now — no account

Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.

Manual scanSlack/email alertsContinuous monitoringWhite-label reports

Drag & drop your dependency file

composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...