CVE-2026-43997

10.0 Critique

Publiée le 13/05/2026 à 20:16 · Modifiée le 07/09/2026 à 15:19 · Modifiée · Source : security-advisories@github.com

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.

Traduire en français

Produits concernés

patriksimek vm2
Red Hat Ansible Automation Platform 2.1
Red Hat Developer Hub
Vm2 project vm2

Scores CVSS

Version	Score	Source	Vecteur
3.1	10.0 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`
3.1	10.0 Critique	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-94
CWE-653

Références

https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6 ExploitVendor Advisory
https://access.redhat.com/errata/RHSA-2026:50850
https://access.redhat.com/security/cve/CVE-2026-43997
https://bugzilla.redhat.com/show_bug.cgi?id=2477203
https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6 ExploitVendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43997.json

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories