PT-2026-38388 · Npm · Vm2

C0Rydoras · CVE-2026-43997 · Published 2026-05-01 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0

Description An issue exists where it is possible to obtain the host Object, allowing an attacker to escape the sandbox. This can be achieved through various methods, such as using the getOwnPropertySymbols() function of HostObject to obtain Symbol(nodejs.util.inspect.custom), potentially leading to remote code execution.

Recommendations Update to version 3.11.0.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

CWE-653

Related Identifiers

BDU:2026-06906

CVE-2026-43997

GHSA-47X8-96VW-5WG6

Affected Products

Vm2

References · 14

• 🔥 https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43997.json · Exploit
• https://osv.dev/vulnerability/GHSA-47x8-96vw-5wg6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43997 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-43997 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-43997 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06906 · Security Note
• https://github.com/patriksimek/vm2/releases/tag/v3.11.0 · Note
• https://github.com/patriksimek/vm2 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2477203 · Note
• https://twitter.com/PurpleOps_io/status/2054781781623099603 · Twitter Post
• https://twitter.com/Tank23x0/status/2065539387191173377 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2026-43997 · Note
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43997.json · Note