CVE-2026-43998 vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape
Attackers can escape the vm2 sandbox via symlink traversal to execute arbitrary code on the host system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43998?
CVE-2026-43998 is a high-severity path traversal vulnerability in patriksimek vm2, published on 13 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve() (which does not dereference symlinks) but module loading uses Node's native require() (which does), an attacker can load arbitrary host-realm modules and achieve remote code execution. This vulnerability is fixed in 3.11.0.
Weakness: CWE-59
Which versions are affected by CVE-2026-43998?
2 open source packages ship an affected version, including vm2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vm2 npm | From 3.10.5 | 3.11.0 |
vm2 npm | From 3.10.5 | 3.11.0 |
Products include Vm2 Project Vm2.
How do I fix CVE-2026-43998?
Upgrade vm2 to 3.11.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-43998 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43998 exists.
Other vulnerabilities in patriksimek vm2
Sources
Also known as GHSA-cp6g-6699-wx9c, ROOT-APP-NPM-CVE-2026-43998.