CVE-2026-43999 describes an incorrect authorization vulnerability (CWE-863) in the vm2 Node.js sandbox prior to version 3.11.0. The vulnerability arises because the builtin module exposes Node's internal Module._load() function, which allows sandboxed code to bypass the builtin allowlist restrictions. This enables loading of excluded built-in modules like child_process, leading to remote code execution in the host environment. The vulnerability has a CVSS v3.1 score of 9.9 (critical) and is fixed in vm2 version 3.11.0. Red Hat advisory confirms the issue and states that an attacker with low privileges who can execute sandboxed code when the builtin module is permitted may exploit this to achieve remote code execution. No known exploits in the wild have been reported. The vendor advisory and Red Hat confirm the fix is available in version 3.11.0.

The vulnerability allows an attacker with the ability to execute sandboxed code in vm2 (when the builtin module is allowed) to bypass sandbox restrictions and load any built-in Node.js module, including sensitive ones like child_process. This leads to remote code execution on the host system, compromising confidentiality, integrity, and availability with high impact. The CVSS score of 9.9 reflects the critical severity of this flaw.

A fix is available in vm2 version 3.11.0. Users should upgrade to vm2 3.11.0 or later to remediate this vulnerability. Until upgraded, avoid allowing the builtin module or the '*' wildcard in the NodeVM builtin allowlist to reduce exposure. The vendor advisory does not mention any other mitigations or temporary fixes.