CVE-2026-43997 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.… | CVSS 10.0 CRITICAL

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.

Metadata

CVE ID: CVE-2026-43997
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-04 20:24 UTC
Published: 2026-05-13 17:17 UTC
Last updated: 2026-07-15 00:55 UTC
Primary CWE: CWE-94
CWE-94: Improper Control of Generation of Code ('Code Inject…
Vendor / Product: patriksimek / vm2
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
patriksimek	vm2	—	< 3.11.0

Weakness (CWE)

CWE	Source	Description
CWE-94	cna	CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-653	adp	Improper Isolation or Compartmentalization

CVSS scores (2)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (1)

https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6 https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6