CVE-2026-43997

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0

Description A flaw in the Node.js sandbox library allows sandboxed code to obtain the host Object. This occurs due to incorrect code generation management and incomplete protections. An attacker can use the host Object to bypass isolation and execute arbitrary code on the host system. One method of exploitation involves using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom).

Recommendations Update vm2 to version 3.11.0.