{"vulnerability": "cve-2026-4400", "sightings": [{"uuid": "31814ebd-96ab-47d9-b5b0-4d8a22813ad5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4400", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mieasagthd2i", "content": "", "creation_timestamp": "2026-03-31T13:10:20.875409Z"}, {"uuid": "4bb37531-2774-4f5b-a5d2-8a7b3b0b77f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4400", "type": "seen", "source": "Telegram/JITBwt8Dx-6YeOa4-kB3D3uVT5le84W_frafpIhKwvPhvSA", "content": "", "creation_timestamp": "2026-03-31T13:18:57.000000Z"}, {"uuid": "0fbdbe78-f989-4674-ae03-3dbc9b6e8dbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44007", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml4tiejjgf2s", "content": "vm2: sandbox escape in NodeVM with nesting:true (CVE-2026-44007)", "creation_timestamp": "2026-05-05T18:39:06.928892Z"}, {"uuid": "43a2e26d-7074-4abc-96b0-6631280abc7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44001", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlrbn3ni6e2c", "content": "CVE-2026-44001 - vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)\nCVE ID : CVE-2026-44001\n \n Published : May 13, 2026, 6:16 p.m. | 2\u00a0hours, 9\u00a0minutes ago\n \n Description : vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbo...", "creation_timestamp": "2026-05-13T21:45:32.352989Z"}, {"uuid": "902d5336-c432-49b5-b497-cee565d3178e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44006", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlrbtta76z2i", "content": "CVE-2026-44006 - vm2: Sandbox Escape\nCVE ID : CVE-2026-44006\n \n Published : May 13, 2026, 6:16 p.m. | 2\u00a0hours, 9\u00a0minutes ago\n \n Description : vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to...", "creation_timestamp": "2026-05-13T21:49:21.251112Z"}, {"uuid": "4eed8bdd-90a5-43f2-afcc-32e9cee21dc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44001", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mlthl3rm5l2q", "content": "\ud83d\udccc CVE-2026-44001 - vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the ho... https://www.cyberhub.blog/cves/CVE-2026-44001", "creation_timestamp": "2026-05-14T18:37:07.923428Z"}, {"uuid": "33056f0f-cc94-4aae-b55d-04296f60eedd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44006", "type": "seen", "source": "https://t.me/bdufstecru/3172", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 BaseHandler.getPrototypeOf() \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 vm2 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430 NPM \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u043d\u044b\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-06907\nCVE-2026-44006\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.0", "creation_timestamp": "2026-05-18T14:18:11.000000Z"}, {"uuid": "e642bf0f-81c4-4407-b146-b2f0ef83cc01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44007", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mmhyplqiny2r", "content": "\ud83d\udccc CVE-2026-44007 - vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('... https://www.cyberhub.blog/cves/CVE-2026-44007", "creation_timestamp": "2026-05-22T22:37:06.598073Z"}, {"uuid": "000fadfd-476f-40a0-9083-2a05f95366f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-44005", "type": "published-proof-of-concept", "source": "https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq", "content": "", "creation_timestamp": "2026-05-01T20:42:00.000000Z"}, {"uuid": "6e71f33b-3c5f-45fc-b3a1-077ef140cd32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-44000", "type": "published-proof-of-concept", "source": "https://github.com/patriksimek/vm2/security/advisories/GHSA-mpf8-4hx2-7cjg", "content": "", "creation_timestamp": "2026-05-01T20:44:26.000000Z"}, {"uuid": "7a70fd26-a340-4835-8c09-5c748987be14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-44009", "type": "published-proof-of-concept", "source": "https://github.com/patriksimek/vm2/security/advisories/GHSA-9vg3-4rfj-wgcm", "content": "", "creation_timestamp": "2026-05-03T21:34:48.000000Z"}, {"uuid": "a8356f78-097b-458a-a436-beda0b7a4aab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-44007", "type": "published-proof-of-concept", "source": "https://github.com/patriksimek/vm2/security/advisories/GHSA-8hg8-63c5-gwmx", "content": "", "creation_timestamp": "2026-05-01T21:29:07.000000Z"}, {"uuid": "d0fb7d1b-2df3-4d1f-a7a5-49c3f41f768b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-44008", "type": "published-proof-of-concept", "source": "https://github.com/patriksimek/vm2/security/advisories/GHSA-9qj6-qjgg-37qq", "content": "", "creation_timestamp": "2026-05-03T21:34:12.000000Z"}, {"uuid": "d59c8797-48b3-4cfd-a811-1936a9598770", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-44003", "type": "published-proof-of-concept", "source": "https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7", "content": "", "creation_timestamp": "2026-05-01T20:44:52.000000Z"}, {"uuid": "44bf8d67-e20a-4c63-a0cd-056b324e1b12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-44004", "type": "published-proof-of-concept", "source": "https://github.com/patriksimek/vm2/security/advisories/GHSA-6785-pvv7-mvg7", "content": "", "creation_timestamp": "2026-05-01T20:43:52.000000Z"}, {"uuid": "a89ac2b1-d89c-4ff5-aac8-e10432f68233", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-44002", "type": "published-proof-of-concept", "source": "https://github.com/patriksimek/vm2/security/advisories/GHSA-v27g-jcqj-v8rw", "content": "", "creation_timestamp": "2026-05-01T20:44:37.000000Z"}, {"uuid": "409fc812-c800-4832-9212-d6fc52357681", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-44001", "type": "published-proof-of-concept", "source": "https://github.com/patriksimek/vm2/security/advisories/GHSA-hw58-p9xv-2mjh", "content": "", "creation_timestamp": "2026-05-01T20:43:31.000000Z"}, {"uuid": "5546f626-22cb-417a-b220-16692f9fc653", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-44006", "type": "published-proof-of-concept", "source": "https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx8", "content": "", "creation_timestamp": "2026-05-01T20:40:54.000000Z"}, {"uuid": "8494a1f3-9a97-4792-b9ed-b670b6f6672e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44006", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq74xrar6422", "content": "CVE-2026-44006 - @rootio/vm2\nThe @rootio/vm2 package in Root:npm has a memory access issue that could be exploited by attackers. This could lead to unauthorized data access or system crashes. Update to a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rootio #Rootnpm #CVE #infosec", "creation_timestamp": "2026-07-09T07:40:04.913853Z"}, {"uuid": "8d34d820-9dad-4fae-a100-93ab180997fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44009", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq753cw5on2d", "content": "CVE-2026-44009 - @rootio/vm2\nA security patch has been released for Root VM2 software, which fixes a vulnerability that could allow unauthorized access. This affects users who rely on Root VM2 for their\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rootio #Rootnpm #CVE #infosec", "creation_timestamp": "2026-07-09T07:42:04.402594Z"}, {"uuid": "f70df046-a752-454d-8a82-6f563e008079", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44005", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq75fzsvsz2q", "content": "CVE-2026-44005 - @rootio/vm2\nIf you're using Root's npm package and haven't updated vm2 recently, you may be at risk of a security issue. This issue has been fixed by Root in newer versions of vm2. We\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rootio #Rootnpm #CVE #infosec", "creation_timestamp": "2026-07-09T07:48:03.379114Z"}, {"uuid": "247fbd77-0031-44b0-af82-6ed585490522", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44008", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq75jncjll2q", "content": "CVE-2026-44008 - @rootio/vm2\nA security patch has been released for Root's VM2 package. If not updated, attackers could potentially gain unauthorized access to Root systems. Update to the latest version of\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rootio #Rootnpm #CVE #infosec", "creation_timestamp": "2026-07-09T07:50:05.345079Z"}, {"uuid": "3bd58e8b-2d4a-47a6-b5da-49b831748611", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44007", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq75n6xlzv2z", "content": "CVE-2026-44007 - @rootio/vm2\nThe vm2 library in Root:npm has a security issue that could allow an attacker to access sensitive information or perform unauthorized actions. This has been fixed by Root in a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rootio #Rootnpm #CVE #infosec", "creation_timestamp": "2026-07-09T07:52:03.743825Z"}, {"uuid": "b6a91a91-44e2-455b-a8d4-8daa2ef5e616", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44005", "type": "seen", "source": "https://t.me/shimiscyberworld/1459", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-44005 \u2014 CVSS 10\nCVE-2026-44005: Critical vm2 Sandbox Escape Threatens Node.js Applications\n\nCVE-2026-44005 \u2014 vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards\n\n\ud83d\udd34 Critical \u00b7 3 ATT&CK techniques mapped\n\n#cve  #critical  #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-44005 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:05.252404Z"}, {"uuid": "7f25664a-d83e-41c4-ac02-e07b83f357ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44006", "type": "seen", "source": "https://t.me/shimiscyberworld/1460", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-44006 \u2014 CVSS 10\nvm2 Sandbox Escape (CVE-2026-44006) Poses Critical Threat to Node.js\n\nCVE-2026-44006 \u2014 vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. T\n\n\ud83d\udd34 Critical \u00b7 2 ATT&CK techniques mapped\n\n#cve  #critical  #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-44006 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:05.286819Z"}, {"uuid": "a4329d5f-99f3-446b-b5b0-d4090400a287", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44006", "type": "seen", "source": "https://t.me/shimiscyberworld/1460", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-44006 \u2014 CVSS 10\nvm2 Sandbox Escape (CVE-2026-44006) Poses Critical Threat to Node.js\n\nCVE-2026-44006 \u2014 vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. T\n\n\ud83d\udd34 Critical \u00b7 2 ATT&CK techniques mapped\n\n#cve  #critical  #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-44006 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-13T00:00:57.016760Z"}, {"uuid": "bff2d27f-b837-49b2-a017-e83269ea4b69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44005", "type": "seen", "source": "https://t.me/shimiscyberworld/1459", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-44005 \u2014 CVSS 10\nCVE-2026-44005: Critical vm2 Sandbox Escape Threatens Node.js Applications\n\nCVE-2026-44005 \u2014 vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards\n\n\ud83d\udd34 Critical \u00b7 3 ATT&CK techniques mapped\n\n#cve  #critical  #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-44005 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-13T00:00:57.057772Z"}]}