GHSA-947F-4V7F-X2V8 vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape

🗓️ 07 May 2026 04:08:55Reported by GoogleType

osv🔗 osv.dev👁 5 Views

Critical vm2 NodeVM sandbox escape via Module._load when module is allowed, enabling host code execution.

Reporter	Title	Published	Views	Family All 17
BDU FSTEC	The vulnerability of the Module._load() function in the built-in module of the vm2 package manager NPM allows a hacker to execute arbitrary code.	18 May 202600:00	–	bdu_fstec
Circl	CVE-2026-43999	1 May 202620:43	–	circl
CNNVD	vm2 安全漏洞	13 May 202600:00	–	cnnvd
CVE	CVE-2026-43999	13 May 202617:21	–	cve
Cvelist	CVE-2026-43999 vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape	13 May 202617:21	–	cvelist
Github Security Blog	vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape	7 May 202604:08	–	github
NVD	CVE-2026-43999	13 May 202618:16	–	nvd
OSV	CVE-2026-43999 vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape	13 May 202617:21	–	osv
OSV	ROOT-APP-NPM-CVE-2026-43999 CVE-2026-43999 in @rootio/vm2 - Patched by Root	4 Jun 202621:05	–	osv
Patchstack	NPM: vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape	7 May 202604:08	–	patchstack

Source	Link
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-947f-4v7f-x2v8
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-43999
github	www.github.com/patriksimek/vm2

14 May 2026 20:49Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.19.9

EPSS0.00974