9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-43999

CVE-2026-43999: vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes Node's Module._load(), which loads any module by name directly in the host context, completely bypassing vm2's builtin restriction. This allows sandboxed code to load excluded builtins like child_process and achieve remote code execution. This vulnerability is fixed in 3.11.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-43999

CVE-2026-43999:

9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vm2	npm	= 3.10.5	3.11.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allowed a sandbox escape in vm2 by exploiting the module built-in. When the module built-in was allowed, it was possible to use Module._load() to load any other Node.js module, including child_process, which could then be used for remote code execution. The vulnerability was present in the addDefaultBuiltin function in lib/builtin.js, which did not properly restrict access to dangerous built-in modules. The patch addresses this by creating a denylist of dangerous modules and modifying addDefaultBuiltin to prevent them from being loaded, even when explicitly requested. The primary vulnerable function is addDefaultBuiltin as it was the function that directly allowed the dangerous module to be loaded into the sandbox.

Vulnerable functions

addDefaultBuiltin

lib/builtin.js

The `addDefaultBuiltin` function was responsible for adding built-in modules to the sandbox. The vulnerability existed because this function would add the 'module' built-in if it was specified in the options, including when the '*' wildcard was used. The 'module' built-in could then be used to load any other module, including dangerous ones like 'child_process', bypassing the sandbox's restrictions. The patch fixes this by adding a denylist of dangerous built-ins and checking against it before adding a module.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.