vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be usi…
Critical CVSS 10.0
Summary
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6 Exploit
- https://access.redhat.com/errata/RHSA-2026:50850
- https://access.redhat.com/security/cve/CVE-2026-43997
- https://bugzilla.redhat.com/show_bug.cgi?id=2477203
- https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6 Exploit
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43997.json
Timeline
- nvd_ingest NVD