CVE-2026-44009

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, This vulnerability is fixed in 3.11.2...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +283 more potentially affected by CVE-2026-44009 via vm2 (>=3.0.0, <=3.11.1)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

stentor (1.72.3), stentor-conditional (1.72.3) +8 more potentially affected by CVE-2026-44000 +1 more via vm2 (3.11.1)

vm2 NPM version 3.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on vm2 and may be impacted: - stentor 1.72.3 - stentor-conditional 1.72.3 - stentor-context 1.72.3 - stentor-determiner 1.72.3 - stentor-handler 1.72.3 - stentor-handler-delegating...