Is CVE-2026-43998 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43998 being exploited in the wild.

How severe is CVE-2026-43998?

High severity, with a CVSS score of 8.5, published 13 May 2026.

Which products and versions are affected?

vm2 (npm) = 3.10.5, SEMVER:introduced=3.10.5,fixed=3.11.0; Red Hat Developer Hub 1; Red Hat Self-service automation portal 2.

Is there a fix for CVE-2026-43998?

Yes. vm2 (npm): upgrade to 3.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43998 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-43998?

Check whether you run vm2 (npm), Red Hat Developer Hub or Red Hat Self-service automation portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43998: patriksimek vm2 remote code execution via symlink traversal in NodeVM

CVE-2026-43998 · Severity: high · CVSS 8.5 · Published 2026-05-13

vm2 is a popular software library used to safely run untrusted code in a restricted 'sandbox' environment. A flaw in how it handles file shortcuts (symlinks) allows an attacker to bypass these restrictions and access sensitive files or run unauthorized commands on the underlying server. This could lead to a full system takeover or the theft of confidential data hosted on the same machine.

Technologies: vm2 (npm), Red Hat Developer Hub, Red Hat Self-service automation portal. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-43998 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43998 being exploited in the wild.
How severe is CVE-2026-43998?: High severity, with a CVSS score of 8.5, published 13 May 2026.
Which products and versions are affected?: vm2 (npm) = 3.10.5, SEMVER:introduced=3.10.5,fixed=3.11.0; Red Hat Developer Hub 1; Red Hat Self-service automation portal 2.
Is there a fix for CVE-2026-43998?: Yes. vm2 (npm): upgrade to 3.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43998 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-43998?: Check whether you run vm2 (npm), Red Hat Developer Hub or Red Hat Self-service automation portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vm2 (npm): upgrade to 3.11.0 or later
```
npm install vm2@3.11.0
```

Technical details

A path traversal vulnerability exists in vm2's NodeVM due to a discrepancy between path validation and module loading. The 'isPathAllowed' method in 'lib/resolver-compat.js' uses 'path.resolve()', which normalizes paths but does not dereference symlinks. However, the subsequent module loading uses Node's native 'require()', which does follow symlinks. An attacker can exploit this by creating a symlink within the allowed root directory that points to a sensitive module or the vm2 library itself outside the root. This allows the attacker to escape the sandbox and execute arbitrary code in the host context. The vulnerability is fixed in version 3.11.0 by dereferencing symlinks before validation.

Affected products

patriksimek vm2 3.10.5
Red Hat Self-service automation portal 2 2
Red Hat Red Hat Developer Hub 1

Identifiers

CVE-2026-43998
GHSA-cp6g-6699-wx9c

Timeline

2026-05-01: advisory: GitHub advisory published by maintainer
2026-05-13: disclosed: CVE published to NVD
2026-05-13: patched: Fixed in version 3.11.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.