CVE-2026-43998

[CVE catalog]

Severity

High · CVSS 8.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Published

May 13, 2026, 5:19:44 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.72% · Oct 25, 2026

A flaw was found in vm2 3.10.5. NodeVM require.root path checks use path.resolve() without dereferencing symlinks, while Node require() follows symlinks, allowing sandboxed code to load host modules outside the allowed root and achieve remote code execution. Fixed in 3.11.0. vm2: vm2: Remote code execution due to path restriction bypass via symlinks vm2 NodeVM is vulnerable to require.root bypass via filesystem symlinks, enabling sandboxed code to load arbitrary host-realm modules. An attacker with low privileges who can run code in a NodeVM with require restrictions and symlink-accessible paths may achieve remote code execution. Fixed in vm2 3.11.0. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.