CVE-2026-43999 Details

A critical vulnerability in vm2, an open-source virtual machine/sandbox for Node.js, allows for a bypass of the NodeVM's built-in allowlist. This issue is present in versions prior to 3.11.0. When the 'module' built-in is allowed, it exposes Node's Module._load() function, which can load any module by name directly in the host context. This bypasses vm2's built-in restrictions and enables sandboxed code to access excluded built-ins like child_process, resulting in remote code execution.

Users are advised to update to vm2 version 3.11.0 or later, and to exclude 'module' from the built-in modules entirely or to add it to the special modules with a safe wrapper.