CVE-2026-43997

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6	Exploit Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:50850
https://access.redhat.com/security/cve/CVE-2026-43997
https://bugzilla.redhat.com/show_bug.cgi?id=2477203
https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6	Exploit Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43997.json

Configurations

Configuration 1 (hide)

cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) vm2 es un vm/sandbox de código abierto para Node.js. Antes de la versión 3.11.0, es posible obtener el objeto host. Existen varias formas de usar el objeto host para escapar de la sandbox; un ejemplo sería usar HostObject.getOwnPropertySymbols para obtener Symbol(nodejs.util.inspect.custom). Esta vulnerabilidad está corregida en la versión 3.11.0.

Information

Published : 2026-05-13 18:16

Updated : 2026-10-26 17:10

NVD link : CVE-2026-43997

Mitre link : CVE-2026-43997

CVE.ORG link : CVE-2026-43997

JSON object : View

Products Affected

vm2_project

vm2

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-653

Improper Isolation or Compartmentalization

{"id": "CVE-2026-43997", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43997", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-13T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "patriksimek", "product": "vm2", "versions": [{"status": "affected", "version": "< 3.11.0"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:ansible_portal:2.1"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.1", "versions": [{"status": "unaffected", "version": "1785854226", "lessThan": "*", "versionType": "rpm"}], "packageName": "ansible-automation-platform/automation-portal", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhdh:1"], "vendor": "Red Hat", "product": "Red Hat Developer Hub", "packageName": "rhdh/rhdh-hub-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-05-13T18:16:16.177", "references": [{"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:50850", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-43997", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477203", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43997.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-653"}]}], "descriptions": [{"lang": "en", "value": "vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0."}, {"lang": "es", "value": "vm2 es un vm/sandbox de c\u00f3digo abierto para Node.js. Antes de la versi\u00f3n 3.11.0, es posible obtener el objeto host. Existen varias formas de usar el objeto host para escapar de la sandbox; un ejemplo ser\u00eda usar HostObject.getOwnPropertySymbols para obtener Symbol(nodejs.util.inspect.custom). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 3.11.0."}], "lastModified": "2026-10-26T17:10:03.270", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "6DD48308-6219-4C66-9BE7-246EE56FB834", "versionEndExcluding": "3.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}