Improper Isolation or Compartmentalization

🗓️ 07 May 2026 05:13:21Reported by Snyk Security DatabaseType

Improper isolation in the Node virtual machine lets sandbox code access host modules and execute commands when nesting is enabled and require is false.

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	The vulnerability of the NPM package manager vm2 library allows a hacker to execute arbitrary commands.	18 May 202600:00	–	bdu_fstec
Circl	CVE-2026-44007	1 May 202621:29	–	circl
CNNVD	vm2 访问控制错误漏洞	13 May 202600:00	–	cnnvd
CVE	CVE-2026-44007	13 May 202617:33	–	cve
Cvelist	CVE-2026-44007 vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution	13 May 202617:33	–	cvelist
Github Security Blog	vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution	7 May 202605:13	–	github
NVD	CVE-2026-44007	13 May 202618:16	–	nvd
OSV	GHSA-8HG8-63C5-GWMX vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution	7 May 202605:13	–	osv
OSV	ROOT-APP-NPM-CVE-2026-44007 CVE-2026-44007 in @rootio/vm2 - Patched by Root	4 Jun 202621:05	–	osv
Patchstack	NPM: vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution	7 May 202605:13	–	patchstack