CVE-2026-43998 Details
Description
vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve() (which does not dereference symlinks) but module loading uses Node's native require() (which does), an attacker can load arbitrary host-realm modules and achieve remote code execution. This vulnerability is fixed in 3.11.0.
A vulnerability in vm2 version 3.10.5 allows for a bypass of the NodeVM's require.root path restriction using filesystem symlinks. This flaw enables sandboxed code to load modules from outside the designated root directory into the host context. The issue arises because path validation employs path.resolve(), which does not follow symlinks, while module loading utilizes Node's require(), which does. As a result, an attacker can load arbitrary host-realm modules, leading to remote code execution. The vulnerability is present in vm2, an open-source virtual machine/sandbox for Node.js, and has been patched in version 3.11.0.
Users can upgrade to vm2 version 3.11.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:50850 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-43998 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477206 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43998.json | redhat-SADP | |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-cp6g-6699-wx9c | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-cp6g-6699-wx9c | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | redhat-SADP |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vm2 project vm2 | 3.10.5 |
CPE
Remediation
| |
Change History
12 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 7, 2026 | CVE Modified | redhat-SADP |
| Sep 4, 2026 | CVE Modified | redhat-SADP |
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | CVE Modified | [email protected] |
| Aug 6, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | New CVE Received | [email protected] |