Is CVE-2026-43999 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43999 being exploited in the wild.

How severe is CVE-2026-43999?

Critical severity, with a CVSS score of 9.9, published 13 May 2026.

Which products and versions are affected?

vm2 (npm) = 3.10.5, SEMVER:introduced=3.10.5,fixed=3.11.0; Red Hat Developer Hub 1; Red Hat Self-service automation portal 2.

Is there a fix for CVE-2026-43999?

Yes. vm2 (npm): upgrade to 3.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43999 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-43999?

Check whether you run vm2 (npm), Red Hat Developer Hub or Red Hat Self-service automation portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43999: patriksimek vm2 remote code execution via NodeVM allowlist bypass

CVE-2026-43999 · Severity: critical · CVSS 9.9 · Published 2026-05-13

vm2 is a popular tool used to safely run untrusted code in a restricted 'sandbox' environment. A critical flaw allows an attacker to bypass these security restrictions and gain full control over the underlying server. This could lead to the theft of sensitive data, service disruption, or the installation of malicious software on the host system.

Technologies: vm2 (npm), Red Hat Developer Hub, Red Hat Self-service automation portal. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-43999 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43999 being exploited in the wild.
How severe is CVE-2026-43999?: Critical severity, with a CVSS score of 9.9, published 13 May 2026.
Which products and versions are affected?: vm2 (npm) = 3.10.5, SEMVER:introduced=3.10.5,fixed=3.11.0; Red Hat Developer Hub 1; Red Hat Self-service automation portal 2.
Is there a fix for CVE-2026-43999?: Yes. vm2 (npm): upgrade to 3.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43999 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-43999?: Check whether you run vm2 (npm), Red Hat Developer Hub or Red Hat Self-service automation portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vm2 (npm): upgrade to 3.11.0 or later
```
npm install vm2@3.11.0
```

Technical details

A vulnerability in vm2's NodeVM allows for a sandbox escape when the 'module' builtin is permitted, which often occurs by default when using the '*' wildcard in the builtin allowlist. The 'module' builtin exposes Node's internal 'Module._load()' method to the sandboxed environment. Because vm2 wraps this builtin in a generic readonly proxy that does not intercept function calls, an attacker can call 'Module._load()' to load restricted modules like 'child_process' directly in the host context. This bypasses all vm2 security restrictions and enables arbitrary command execution. The issue is fixed in version 3.11.0 by properly excluding dangerous builtins from the default expansion.

Affected products

patriksimek vm2 < 3.11.0
Red Hat Self-service automation portal 2 2
Red Hat Red Hat Developer Hub 1

Identifiers

CVE-2026-43999
GHSA-947f-4v7f-x2v8

Timeline

2026-05-01: advisory: GitHub advisory published by maintainer
2026-05-13: disclosed: CVE-2026-43999 assigned and published to NVD
2026-05-13: patched: Vulnerability fixed in version 3.11.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.