{"id":"EUVD-2026-30069","enisaUuid":"c8b9ce58-0f83-3c74-a6c5-6c0643653901","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM\u0027s builtin allowlist can be bypassed when the module builtin is allowed (including via the \u0027*\u0027 wildcard). The module builtin exposes Node\u0027s Module._load(), which loads any module by name directly in the host context, completely bypassing vm2\u0027s builtin restriction. This allows sandboxed code to load excluded builtins like child_process and achieve remote code execution. This vulnerability is fixed in 3.11.0.","datePublished":"May 13, 2026, 5:21:22 PM","dateUpdated":"Sep 7, 2026, 12:05:02 PM","baseScore":9.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-947f-4v7f-x2v8\n","aliases":"CVE-2026-43999\nGHSA-947f-4v7f-x2v8\n","assigner":"GitHub_M","epss":0.97,"enisaIdProduct":[{"id":"5ac5d5c6-59f5-37f3-b550-1db61c3780c9","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.0"}],"enisaIdVendor":[{"id":"878b3147-1ec4-3a5c-ae73-a069f65e8271","vendor":{"name":"patriksimek"}}],"enisaIdVulnerability":[{"id":"ba0ba5bf-1288-3ad5-8cf9-1b3d66b05118","vulnerability":{"id":"GHSA-947f-4v7f-x2v8","description":"vm2 has a NodeVM builtin allowlist bypass via `module` builtin\u0027s `Module._load` that allows sandbox escape","datePublished":"May 7, 2026, 4:08:55 AM","dateUpdated":"May 14, 2026, 8:36:36 PM","baseScore":0.0,"references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-947f-4v7f-x2v8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43999\nhttps://github.com/patriksimek/vm2\n","enisa_id":"EUVD-2026-30069\n","aliases":"GHSA-947f-4v7f-x2v8\nCVE-2026-43999\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fdeb3364-92c1-3a3d-9a98-d51fe2aa503c","vulnerability":{"id":"CVE-2026-43999","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM\u0027s builtin allowlist can be bypassed when the module builtin is allowed (including via the \u0027*\u0027 wildcard). The module builtin exposes Node\u0027s Module._load(), which loads any module by name directly in the host context, completely bypassing vm2\u0027s builtin restriction. This allows sandboxed code to load excluded builtins like child_process and achieve remote code execution. This vulnerability is fixed in 3.11.0.","datePublished":"May 13, 2026, 5:21:22 PM","dateUpdated":"Sep 7, 2026, 12:05:02 PM","status":"PUBLISHED","baseScore":9.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-947f-4v7f-x2v8\n","enisa_id":"EUVD-2026-30069\n","assigner":"GitHub_M","epss":0.97,"dataProcessed":"Nov 3, 2026, 7:18:02 AM","vulnerabilityProduct":[{"id":"104f967c-e85f-3406-a9a0-46fe79017cbe","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.0"}],"vulnerabilityVendor":[{"id":"598f72aa-f494-3381-8816-26e90700880f","vendor":{"name":"patriksimek"}}]}}],"enisaIdAdvisory":[{"id":"87f69491-58ab-3292-9441-24bfb75001cb","advisory":{"id":"RHSA-2026:50850","description":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update","summary":"Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.","datePublished":"Aug 5, 2026, 4:35:19 PM","dateUpdated":"Oct 31, 2026, 3:41:27 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:50850\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50850.json\n","aliases":"CVE-2026-9277\nCVE-2026-43997\nCVE-2026-43998\nCVE-2026-43999\nCVE-2026-44000\nCVE-2026-44001\nCVE-2026-44002\nCVE-2026-44003\nCVE-2026-44004\nCVE-2026-44005\nCVE-2026-44006\nCVE-2026-44007\nCVE-2026-44008\nCVE-2026-44009\nCVE-2026-45411\nCVE-2026-47131\nCVE-2026-47135\nCVE-2026-47137\nCVE-2026-47139\nCVE-2026-47140\nCVE-2026-47141\nCVE-2026-47209\nCVE-2026-48068\nCVE-2026-48801\nCVE-2026-59877\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"311ecff8-8324-3291-b7f2-d8b3178ab547","product":{"name":"registry.redhat.io/ansible-automation-platform/automation-portal@sha256:a85a548cb563a32be76c6e7e015fd57d340e068e321bf34b060d9eb901c33c4d_amd64","vendor":{"name":"Red Hat"}}},{"id":"31e60952-0a9a-3915-aadb-28544aea82d4","product":{"name":"Red Hat Ansible Automation Platform 2.1","vendor":{"name":"Red Hat"}}},{"id":"860f696f-a4de-3063-8cce-cf79cc54207b","product":{"name":"Self-service automation portal 2.1","vendor":{"name":"Red Hat"}}}]}}]}