Loading vulnerability…
vm2 NodeVM Builtin Allowlist Bypass via Module._load
CVE-2026-43999 is a security-bypass vulnerability in the vm2 Node.js sandbox prior to version 3.11.0. In NodeVM configurations that permit the module builtin, either explicitly or through the '*' wildcard, sandboxed code can access Node's Module._load() API. Because this API loads modules directly in the host context, it bypasses vm2's builtin-module restriction mechanism and permits loading otherwise excluded builtins, including child_process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker able to execute code in an affected NodeVM can escape the intended builtin-module restrictions, load host-context Node.js builtins that administrators excluded, and achieve remote code execution. This can result in arbitrary code execution within the host environment running vm2.
If you can’t patch tonight, do this now.
Until vm2 is upgraded, do not permit the module builtin in NodeVM configurations. Avoid using the '*' builtin wildcard where it causes module to be allowed; use a narrowly scoped allowlist that excludes module.
Patch, then assume compromise.
Upgrade vm2 to version 3.11.0 or later, which fixes CVE-2026-43999.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.