CVE-2026-45411: RCE in vm2 Node.js Sandbox

The impact of CVE-2026-45411 is severe. Successful exploitation allows an attacker to bypass the intended isolation of the vm2 sandbox and gain direct access to the host system. This could involve executing malicious code, stealing sensitive data, installing malware, or establishing persistent backdoors. The ability to execute arbitrary commands effectively grants the attacker complete control over the affected system. This vulnerability shares similarities with sandbox escape vulnerabilities where improper exception handling leads to privilege escalation and code execution outside the intended boundaries.

1. Reservado2026-05-12
2. Publicada2026-05-13

The primary mitigation for CVE-2026-45411 is to immediately upgrade to vm2 version 3.11.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by carefully reviewing and sanitizing any user-provided code executed within the vm2 sandbox. While not a complete solution, restricting the permissions of the process running vm2 can limit the potential damage. Monitor system logs for unusual activity or errors related to vm2, which could indicate exploitation attempts. After upgrading, confirm the fix by attempting to trigger the vulnerability with known exploit patterns and verifying that the sandbox remains intact.