PatchSiren cyber security CVE debrief

CVE-2026-43998 patriksimek CVE debrief

CVE-2026-43998 is a high-severity vulnerability in vm2, a Node.js sandbox, that allows attackers to bypass path restrictions and execute arbitrary code. The vulnerability exists in version 3.10.5 of vm2 and is caused by a discrepancy between path validation and module loading. An attacker can exploit this vulnerability by creating a symlink to a module outside the allowed root directory, allowing them to load arbitrary host-realm modules and achieve remote code execution. This vulnerability has been fixed in version 3.11.0 of vm2. The CVE was published on May 13, 2026, and last modified on June 30, 2026.

Vendor: patriksimek
Product: vm2
CVSS: HIGH 8.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-13
Original CVE updated: 2026-09-07
Advisory published: 2026-05-13
Advisory updated: 2026-09-07

Who should care

Developers and administrators using vm2 version 3.10.5 or earlier should be concerned about this vulnerability. They should update to version 3.11.0 or later to prevent potential attacks. Additionally, users of Node.js applications that utilize vm2 should also be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability in vm2 arises from the use of path.resolve() for path validation, which does not dereference symlinks, while module loading uses Node's native require(), which does. This discrepancy allows an attacker to create a symlink to a module outside the allowed root directory, effectively bypassing the path restriction. The attacker can then load arbitrary host-realm modules, leading to remote code execution. The vulnerability has a CVSS score of 8.5 and is classified as HIGH severity.

Defensive priority

High priority should be given to updating vm2 to version 3.11.0 or later. In the meantime, defenders should monitor for potential exploitation attempts and restrict access to sensitive areas of the system.

Recommended defensive actions

Update vm2 to version 3.11.0 or later
Monitor for potential exploitation attempts
Restrict access to sensitive areas of the system
Implement additional security measures, such as intrusion detection and prevention systems
Conduct regular vulnerability assessments and penetration testing

Evidence notes

The CVE-2026-43998 vulnerability was published on May 13, 2026, and last modified on June 30, 2026. The vulnerability has a CVSS score of 8.5 and is classified as HIGH severity. The vulnerability affects vm2 version 3.10.5 and earlier. The fix for this vulnerability is included in vm2 version 3.11.0.

Sources and references

Verified primary and authoritative sources

CVE-2026-43998 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-43998

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-43998 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43998

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://github.com/patriksimek/vm2/security/advisories/GHSA-cp6g-6699-wx9c

[email protected] - Exploit, Mitigation, Vendor Advisory
Source reference
Unverified legacy reference

URL: https://access.redhat.com/security/cve/CVE-2026-43998

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43998.json

0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.