CVE-2026-43997
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
A vulnerability in the vm2 library for Node.js prior to version 3.11.0 allows obtaining the host object. Attackers can use various methods, e.g., HostObject.getOwnPropertySymbols, to obtain Symbol(nodejs.util.inspect.custom) and escape the sandbox.
Risk Assessment
The risk involves complete bypass of sandbox isolation, potentially leading to arbitrary code execution on the server and compromising data confidentiality and integrity.
Recommendation
Immediately update the vm2 library to version 3.11.0 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.