CVE-2026-44008

Name of the Vulnerable Software and Affected Versions VM2 (affected versions not specified)

Description A sandbox breakout allows attackers to execute arbitrary commands on the host system. The issue occurs because the neutralizeArraySpeciesBatch() function interacts with objects from an external context and can trigger a getter on the array prototype, exposing host objects into the sandbox. This mechanism enables an attacker to obtain the host Function object and achieve remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.