CVE-2026-43997CRITICAL 10.0EPSS p58.7%

CVE-2026-43997CVE-2026-43997

vm2_project / vm2

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.

Scoring

CVSS 3.110.0 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS0.98% probability of exploitation · percentile 58.7% · 2026-08-03T12:00:16Z
Published2026-05-13
Last modified2026-07-15

Underlying weaknesses· 1

CWE-94

References

  1. https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6
  2. https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6

1

TypeTargetConfidenceTier
WeaknessImproper Control of Generation of Code ('Code Injection')cwe-940%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-26956
CVE
CVE-2026-44005
CVE
CVE-2026-24781
CVE
CVE-2026-44008
CVE
CVE-2026-24118
CVE
CVE-2026-44009
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.