Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-07 | 2 | Disclosure2 |
| 2026-05-14 | 1 | Patch1 |
| 2026-05-28 | 1 | Patch1 |
| 2026-06-15 | 1 | General1 |
CVE-2026-44006 is a good patch-discipline check. vm2 / sandbox escape. Public details are enough to start scoping. What detection would tell you this moved from advisory to activity?
Post summary
The note highlights CVE-2026-44006 as a patch-discipline check, references a vm2 sandbox escape, but lacks details on PoC, exploits, or patches, leaving classification as general information.
5 Critical CVEs to Fix Now - vm2 sandbox Affected: vm2; Fleet Helm deployer; ERPNext Internet-facing risks dominate, led by sandbox escapes in Node.js vm2 and exposure through automation tooling. • CVE-2026-43997 (CVSS 10.0) iControl REST vulnerability allows a highly privileged, authenticated attacker with at least the Manager role to create configuration objects that allow running arbitrary commands. Affected versions: unspecified. • CVE-2026-44005 (CVSS 10.0) vm2's bridge exposes mutable proxies for host-realm intrinsic prototypes and forwards sandbox writes into the underlying host objects, enabling host compromise; fixed in 3.11.0. Affected versions: 3.9.6-3.10.5. • CVE-2026-44006 (CVSS 10.0) vm2 prior to 3.11.0 allows reaching BaseHandler.getPrototypeOf to obtain arbitrary prototypes, enabling host access and command execution. Affected versions: <3.11.0. • CVE-2026-41050 (CVSS 9.9) Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to read secrets from any namespace on every downstream cluster targeted by their GitRepo. Affected versions: unspecified. • CVE-2026-44442 (CVSS 9.9) ERPNext before 16.9.1 fails to enforce proper authorization checks, allowing data modification beyond the holder’s permitted role. Affected versions: before 16.9.1. 🛠️ Action • Patch vm2 to the fixed 3.11.x series (≥3.11.0, ideally 3.11.2+); upgrade ERPNext to 16.9.1 or later; apply vendor advisories for Fleet Helm deployer. • Prioritize internet-facing instances and edge appliances for remediation first. • If a fix is not available yet, apply mitigations: restrict exposure, disable risky features, rotate credentials where applicable. • Add detections for exploitation patterns: sandbox escapes, host-prototype mutations, unauthorized API/config changes, and unusual process spawns. • Hunt for indicators in logs, EDR, WAF related to the affected services during the disclosure window. • Validate remediation with version checks and configuration verification, and monitor for reversion or new indicators.
Post summary
The post announces five critical CVEs affecting vm2, Fleet Helm deployer, and ERPNext, provides detailed technical information, and focuses on patching and mitigation steps to remediate these high‑severity vulnerabilities.
🚨 Critical - Node.js vm2 Sandbox Escape (CVE-2026-44006) A critical vulnerability in the vm2 library allows unauthenticated attackers to escape the sandbox via the BaseHandler.getPrototypeOf method. By manipulating object prototypes through internal bridge functions, an attacker can gain access to the host's process object and execute arbitrary system commands (RCE). 👉 Affected: vm2 <= 3.10.5 | Upgrade to 3.11.0
Post summary
The post announces a critical sandbox escape vulnerability (CVE-2026-44006) in vm2 that allows unauthenticated RCE, and recommends upgrading to version 3.11.0.
🚨 CRITICAL: CVE-2026-44006 | CVSS 10.0 vm2 Node.js sandbox escape vulnerability allows arbitrary prototype access. Affects versions <3.11.0. Patch immediately to 3.11.0+ #CVE #PatchNow #ThreatIntel https://t.co/ynCscPgys4
Post summary
The tweet announces CVE‑2026‑44006, a critical Node.js vm2 sandbox escape that enables arbitrary prototype access, and urges users to patch to version 3.11.0 or higher; no evidence of exploitation or PoC is provided.
🔴 vm2 (Nodejs library), Code Injection, #CVE-2026-44006 (Critical) https://dailycve.com/vm2-nodejs-library-code-injection-cve-2026-44006-critical/
Post summary
A critical code injection flaw has been disclosed in the vm2 Node.js library (CVE-2026-44006); further details are linked, but no exploit or patch information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vm2_project | vm2 | - | node.js | - |