9.9
Critical
CVE-2026-43999 vm2 is an open source vm/sandbox for Node.js
Description
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes Node's Module._load(), which loads any module by name directly in the host context, completely bypassing vm2's builtin restriction. This allows sandboxed code to load excluded builtins like child_process and achieve remote code execution. This vulnerability is fixed in 3.11.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| vm2 3.11 | earliest → < 3.11.0 | 3.11.0 |
| Self-service automation portal 2 | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat Ansible Automation Platform 2.1 1785854226 | earliest → < 1785854226 | 1785854226 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of vm2
The 77 CVEs of vm2 →
CVE-2026-100723
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength…
6.9
Medium
CVE-2026-100722
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap
8.9
High
CVE-2026-100721
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver
9.5
Critical
CVE-2026-93606
vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`
10.0
Critical