CVE-2026-43997 — vm2: Sandbox Escape

Description (CNA)

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.

Affected (CNA)

Vendor / product	Versions
patriksimek / vm2	affected < 3.11.0

CWE

CWE-94

References

https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6

redhat-SADP

A flaw was found in vm2 (before 3.11.0), a Node.js sandbox library. Sandboxed code can obtain the host Object (e.g. via HostObject.getOwnPropertySymbols and Symbol(nodejs.util.inspect.custom)), bypassing isolation and enabling arbitrary code execution on the host.

https://access.redhat.com/security/cve/CVE-2026-43997
https://bugzilla.redhat.com/show_bug.cgi?id=2477203
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43997.json
https://access.redhat.com/errata/RHSA-2026:50850