Cyber Resilience

CVE-2026-43998

HighPublic PoCUpdated

Published: 13 May 2026

Published
13 May 2026
Modified
30 June 2026
KEV Added
Patch
CVSS Score v3.1 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0072 49.4th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-43998 is a high-severity Link Following (CWE-59) vulnerability in Vm2 Project Vm2. Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 49.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve()…

more

(which does not dereference symlinks) but module loading uses Node's native require() (which does), an attacker can load arbitrary host-realm modules and achieve remote code execution. This vulnerability is fixed in 3.11.0.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Sandbox escape in Node.js vm2 directly enables arbitrary JavaScript execution on host (T1059.007) via module loading bypass and constitutes exploitation for privilege escalation from sandboxed context (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-44005Same product: Vm2 Project Vm2
CVE-2026-22709Same product: Vm2 Project Vm2
CVE-2026-44009Same product: Vm2 Project Vm2
CVE-2026-45411Same product: Vm2 Project Vm2
CVE-2026-24118Same product: Vm2 Project Vm2
CVE-2026-24781Same product: Vm2 Project Vm2
CVE-2026-44000Same product: Vm2 Project Vm2
CVE-2026-43999Same product: Vm2 Project Vm2
CVE-2026-43997Same product: Vm2 Project Vm2
CVE-2026-44006Same product: Vm2 Project Vm2

Affected Assets

vm2 project
vm2
3.10.5

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References