CVE-2026-43999 vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape
Attackers can escape the vm2 sandbox and execute arbitrary code by loading excluded builtins via the module builtin, requiring the module builtin to be allowed in configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43999?
CVE-2026-43999 is a critical code injection vulnerability in patriksimek vm2, published on 13 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes Node's Module._load(), which loads any module by name directly in the host context, completely bypassing vm2's builtin restriction. This allows sandboxed code to load excluded builtins like child_process and achieve remote code execution. This vulnerability is fixed in 3.11.0.
Which versions are affected by CVE-2026-43999?
2 open source packages ship an affected version, including vm2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vm2 npm | From 3.10.5 | 3.11.0 |
vm2 npm | From 3.10.5 | 3.11.0 |
Products include Vm2 Project Vm2.
How do I fix CVE-2026-43999?
Upgrade vm2 to 3.11.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-43999 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43999 exists.
Other vulnerabilities in patriksimek vm2
Sources
Also known as GHSA-947f-4v7f-x2v8, ROOT-APP-NPM-CVE-2026-43999.