Link following in vm2 - CVE-2026-43998
Published: May 4, 2026
Vulnerability identifier: #VU129590
CSH Severity: Medium
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-43998
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on the host system.
The vulnerability exists due to improper link resolution before file access in NodeVM require.root path restriction enforcement in lib/resolver-compat.js and lib/filesystem.js when loading modules through symlinks from within an allowed root directory in host context. A remote user can submit sandboxed code that requires a specially linked module to execute arbitrary code on the host system.
Exploitation requires symlinks inside the allowed root that point outside it, and is possible when NodeVM is configured with require context set to host.
Affected software
vm2
How to mitigate CVE-2026-43998
Install security update from vendor's website.
vm2 - update to 3.11.0