10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44006

CVE-2026-44006: vm2: Sandbox Escape

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44006

CVE-2026-44006:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vm2	npm	<= 3.10.5	3.11.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-qcp4-v2jj-fjx8, is a sandbox escape in vm2. The root cause is the ability to leak a BaseHandler proxy handler instance from the sandbox environment, primarily through util.inspect({showProxy:true}). Once leaked, the trap methods on this handler (e.g., getPrototypeOf, get, set) could be called directly with a forged target argument. These traps lacked validation to ensure that the target they were operating on was the legitimate, intended target of the proxy.

An attacker could exploit this by providing an arbitrary host object as the target. The PoC demonstrates this by using handler.getPrototypeOf to walk the prototype chain of host objects, eventually gaining access to the host's Function constructor and achieving remote code execution.

The patch addresses this by introducing a validateHandlerTarget function. This function is called at the entry point of every proxy trap within BaseHandler and its subclasses (ProtectedHandler, ReadOnlyHandler, ReadOnlyMockHandler). It maintains a WeakMap to pair each handler with its legitimate target at creation time. Any subsequent trap invocation with a mismatched or unregistered target results in an error, effectively closing the vulnerability. All the patched trap methods were vulnerable to this same fundamental flaw.

Vulnerable functions

BaseHandler.getPrototypeOf

lib/bridge.js

The vulnerability lies in the `getPrototypeOf` trap of `BaseHandler`. A leaked handler instance could be used to call this method with a forged `target` argument. This allows an attacker to traverse the prototype chain of arbitrary host objects, leading to a sandbox escape and remote code execution. The patch adds the `validateHandlerTarget` call to ensure the `target` matches the one associated with the handler.

BaseHandler.get

lib/bridge.js

This function, a proxy trap, was vulnerable because it did not validate the `target` argument. An attacker could leak a handler and call this trap with a forged `target` to read properties from arbitrary host objects, contributing to a sandbox escape.

BaseHandler.set

lib/bridge.js

This proxy trap was vulnerable as it lacked validation for the `target` argument. A leaked handler could be used to call this trap with a forged `target`, allowing an attacker to write properties to arbitrary host objects, leading to prototype pollution or other forms of sandbox escape.

BaseHandler.apply

lib/bridge.js

The `apply` trap was vulnerable due to the missing `target` validation. An attacker with a leaked handler could invoke this trap with a forged `target`, allowing them to execute host functions in an unintended context, which could be leveraged for sandbox escape.

BaseHandler.construct

lib/bridge.js

This constructor trap was vulnerable because it didn't validate the `target`. A leaked handler could be used to call this trap with a forged `target`, allowing an attacker to instantiate host objects, which is a primitive for sandbox escape.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.