Code Injection in vm2 - CVE-2026-43997
Published: May 4, 2026
Vulnerability identifier: #VU129592
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-43997
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of code generation in the vm2 sandbox when processing crafted JavaScript code. A remote attacker can supply specially crafted code to escape the sandbox and execute arbitrary code.
The issue allows access to host objects outside the intended sandbox boundary.
Affected software
vm2
How to mitigate CVE-2026-43997
Install security update from vendor's website.
vm2 - update to 3.11.0