vm2 Project vm2 3.10.5 for Node.js

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:vm2_project:vm2:3.10.5:*:*:*:*:node.js:*:*

part: a version: 3.10.5 update: *

VendorVm2 Project (7b3791c6-3201-5506-9cb5-b1c8e05b05e9)
ProductVm2 (2d74fa4d-af5e-5a69-aa62-75628f679374)
Edition*
Language*
Software edition*
Target softwarenode.js
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/patriksimek/vm2 purl2cpe 2026-06-01 10:12:45.847449
pkg:npm/vm2 purl2cpe 2026-06-01 10:12:45.847451

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-43998 vulnerable 2026-06-08 08:03:18.059742 vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape
HIGH (8.5)
vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve() (which does not dereference symlinks) but module loading uses Node's native require() (which does), an attacker can load arbitrary host-realm modules and achieve remote code execution. This vulnerability is fixed in 3.11.0.
Published: 2026-05-13T17:19:44.406Z
Updated: 2026-09-07T12:04:49.951Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.