THREAT OPS › Threat News › [NVD] CVE-2026-43998 (HIGH 8.5) — vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve()
[NVD] CVE-2026-43998 (HIGH 8.5) — vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve()
CVE-2026-43998 CVSS: 8.5 HIGH Published: 2026-05-13T18:16:16.317
vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve() (which does not dereference symlinks) but module loadi
Indicators of compromise
- CVE-2026-43998cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-43998