Incorrect Resource Transfer Between Spheres

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Incorrect Resource Transfer Between Spheres incomplete filtering of Node.js registered internal symbols across the sandbox boundary. An attacker can...

CVE-2026-43997: Improper Control of Generation of Code

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbolnodejs.util.inspect.custom. This vulnerability...