vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.
The following code is for security research and authorized testing only.
python
const {VM} = require('vm2');
const vm = new VM();
// Conceptual PoC for CVE-2026-44006
// This demonstrates triggering the prototype access
const maliciousCode = `
try {
// Attempting to trigger BaseHandler.getPrototypeOf
// to access arbitrary prototypes and escape sandbox
const obj = {};
const proto = Object.getPrototypeOf(obj);
// Further exploitation logic would go here to achieve RCE
"Sandbox Escape Successful";
} catch (e) {
e.message;
}
`;
console.log(vm.run(maliciousCode));