Path Traversal Vulnerability in vm2 Sandbox for Node.js by Patrik Simek

CVE-2026-43998

What is CVE-2026-43998?

The vm2 library, a popular open-source sandboxing solution for Node.js, is susceptible to a path traversal vulnerability in version 3.10.5. This flaw allows attackers to bypass the NodeVM's require.root path restriction by utilizing filesystem symlinks. Due to the discrepancy between path validation methods and module loading processes, attackers can exploit this vulnerability to load arbitrary modules from the host system, potentially leading to remote code execution. The issue has been resolved in version 3.11.0, emphasizing the importance of upgrading to secure the environment against unauthorized access.

References