Incorrect authorization in vm2 - CVE-2026-43999
Published: May 4, 2026
Vulnerability identifier: #VU129589
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-43999
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on the host system.
The vulnerability exists due to improper access control in the NodeVM builtin allowlist handling for the module builtin when processing sandboxed code that can require builtins. A remote user can invoke Module._load() through the allowed module builtin to execute arbitrary code on the host system.
Exploitation requires the module builtin to be allowed, including through the '*' wildcard, and results in a sandbox escape into the host context.
Affected software
vm2
How to mitigate CVE-2026-43999
Install security update from vendor's website.
vm2 - update to 3.11.0