CVE-2026-43999: vm2 Package Allowlist Bypass Leading to Remote Code Execution
Summary
CVE-2026-43999: NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). Affects vm2 versions >= 3.10.5, < 3.11.0. Fixed in 3.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for executing untrusted code securely. It allows developers to run scripts in a controlled manner, limiting access to the host system's resources. However, the package has a critical vulnerability that can lead to unauthorized access to the host environment, compromising security.
Vulnerability Detail
The vulnerability arises from a bypass in the NodeVM's builtin allowlist when the 'module' builtin is included. This allows sandboxed code to access Node's Module._load() function, enabling it to load any module, including excluded ones like 'child_process'. This can lead to remote code execution (RCE) as attackers can execute arbitrary commands on the host system. The issue is rooted in the way builtins are handled in the code, where the 'module' builtin is not properly isolated, allowing it to bypass security restrictions.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.0
This is the first release that contains the fix.
npm install vm2@3.11.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, a temporary workaround is to avoid using the 'module' builtin in your configuration. Instead, explicitly list only the necessary builtins that your application requires, excluding 'module'. For example:
const vm = new NodeVM({ require: { builtin: ['fs', 'path'], external: false } });
Conclusion
The vm2 package has a critical vulnerability (CVE-2026-43999) that allows for a bypass of the builtin allowlist, leading to potential remote code execution. It is crucial to update to version 3.11.0 or later to secure your application. If immediate updates are not feasible, consider implementing workarounds to mitigate risks.
See every vulnerability recorded for vm2 →
FAQ
CVE-2026-43999 is a critical vulnerability in the vm2 package that allows for a bypass of the builtin allowlist, leading to potential remote code execution.
If your application uses the vm2 package with the 'module' builtin allowed, it may be susceptible to remote code execution, allowing attackers to execute arbitrary commands on your host system.
The CVSS score of this vulnerability is 9.9, indicating a critical severity level.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply using your package-lock.json file, you can check for vulnerabilities without needing to install anything.
If you cannot update the vm2 package right away, consider implementing a workaround by excluding the 'module' builtin from your configuration to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
