vm2 3.10.5 NodeVM require.root SYMLINK bypass RCE
CVE-2026-43998 Published on May 13, 2026
vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape
vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve() (which does not dereference symlinks) but module loading uses Node's native require() (which does), an attacker can load arbitrary host-realm modules and achieve remote code execution. This vulnerability is fixed in 3.11.0.
Vulnerability Analysis
CVE-2026-43998 is exploitable with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-43998. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2026-43998 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2026-43998
stack.watch emails you whenever new vulnerabilities are published in Red Hat Ansible Portal or Red Hat Rhdh. Just hit a watch button to start following.
Affected Versions
patriksimek vm2:- Version 3.10.5 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.