ROOT-APP-NPM-CVE-2026-44001 CVE-2026-44001 in @rootio/vm2 - Patched by Root

Root has patched CVE-2026-44001 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

CVE-2026-44001

Summary : CVE-2026-44001 affects vm2 before version 3.11.0, where a sandbox escape allows sandboxed code to crash the host Node.js process via an unhandled rejection from a Promise executor. The issue stems from the executor path not being sanitized, even though the earlier CVE-2026-22709 fix add...

CVE-2026-44001

creationtimestamp| type| source ---|---|--- 2026-05-01 20:43:31+00:00| published-proof-of-concept| https://github.com/patriksimek/vm2/security/advisories/GHSA-hw58-p9xv-2mjh 2026-05-13 21:45:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlrbn3ni6e2c 2026-05-14 18:37:07+00:00|...