8.5
High
CVE-2026-43998 vm2 is an open source vm/sandbox for Node.js
Description
vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve() (which does not dereference symlinks) but module loading uses Node's native require() (which does), an attacker can load arbitrary host-realm modules and achieve remote code execution. This vulnerability is fixed in 3.11.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| vm2 | 3.10.5 | No fix stated |
| Self-service automation portal 2 | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat Ansible Automation Platform 2.1 1785854226 | earliest → < 1785854226 | 1785854226 |
| Self-service automation portal 2.1 1785854226 | earliest → < 1785854226 | 1785854226 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of vm2
The 77 CVEs of vm2 →
CVE-2026-100723
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength…
6.9
Medium
CVE-2026-100722
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap
8.9
High
CVE-2026-100721
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver
9.5
Critical
CVE-2026-93606
vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`
10.0
Critical