CVE-2026-45411: RCE in vm2 Node.js Sandbox
Platform
nodejs
Component
vm2
Fixed in
3.11.3
CVE-2026-45411 affects the vm2 Node.js sandbox, a tool used for creating isolated JavaScript environments. This vulnerability allows attackers to escape the sandbox and execute arbitrary commands on the host system, potentially leading to complete system compromise. The vulnerability impacts versions 0.0.0 up to and including 3.11.2. A fix is available in version 3.11.3.
Impact and Attack Scenarios
The impact of CVE-2026-45411 is severe. Successful exploitation allows an attacker to bypass the intended isolation of the vm2 sandbox and gain direct access to the host system. This could involve executing malicious code, stealing sensitive data, installing malware, or establishing persistent backdoors. The ability to execute arbitrary commands effectively grants the attacker complete control over the affected system. This vulnerability shares similarities with sandbox escape vulnerabilities where improper exception handling leads to privilege escalation and code execution outside the intended boundaries.
Exploitation Context
CVE-2026-45411 was published on 2026-05-13. Its severity is rated CRITICAL (CVSS 9.8). Exploitation context is currently limited, with no known active campaigns or widespread exploitation. Public proof-of-concept (POC) code is likely to emerge given the vulnerability's severity and ease of exploitation. It is not currently listed on KEV or EPSS, but the high CVSS score suggests a medium to high probability of exploitation if a POC is released.
Threat Intelligence
Exploit Status
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
Mitigation and Workarounds
The primary mitigation for CVE-2026-45411 is to immediately upgrade to vm2 version 3.11.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by carefully reviewing and sanitizing any user-provided code executed within the vm2 sandbox. While not a complete solution, restricting the permissions of the process running vm2 can limit the potential damage. Monitor system logs for unusual activity or errors related to vm2, which could indicate exploitation attempts. After upgrading, confirm the fix by attempting to trigger the vulnerability with known exploit patterns and verifying that the sandbox remains intact.
How to fix
Actualice a la versión 3.11.3 o superior para mitigar la vulnerabilidad. Esta versión corrige el problema al manejar correctamente las excepciones dentro de los generadores asíncronos, evitando la posibilidad de escape del sandbox.
Frequently asked questions
What is CVE-2026-45411 — RCE in vm2 Node.js Sandbox?
CVE-2026-45411 is a critical Remote Code Execution (RCE) vulnerability in the vm2 Node.js sandbox, allowing attackers to escape the sandbox and execute arbitrary code on the host system. It affects versions 0.0.0 through 3.11.2.
Am I affected by CVE-2026-45411 in vm2?
Yes, if you are using vm2 versions 0.0.0 through 3.11.2, you are vulnerable to this RCE. Immediately check your installed version and upgrade if necessary.
How do I fix CVE-2026-45411 in vm2?
The recommended fix is to upgrade to vm2 version 3.11.3 or later. This version includes a patch that addresses the vulnerability. If immediate upgrade is not possible, consider temporary workarounds like code review and permission restrictions.
Is CVE-2026-45411 being actively exploited?
Currently, there are no confirmed reports of active exploitation. However, given the vulnerability's severity and potential impact, exploitation is likely if a public proof-of-concept is released.
Where can I find the official vm2 advisory for CVE-2026-45411?
Refer to the vm2 project's GitHub repository and associated security advisories for the latest information and updates regarding CVE-2026-45411: [https://github.com/vm2js/vm2](https://github.com/vm2js/vm2)
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...