{
  "threat_severity" : "Important",
  "public_date" : "2026-05-13T17:21:22Z",
  "bugzilla" : {
    "description" : "vm2: vm2: Remote code execution via NodeVM builtin allowlist bypass",
    "id" : "2477196",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2477196"
  },
  "cvss3" : {
    "cvss3_base_score" : "9.9",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-829",
  "details" : [ "vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes Node's Module._load(), which loads any module by name directly in the host context, completely bypassing vm2's builtin restriction. This allows sandboxed code to load excluded builtins like child_process and achieve remote code execution. This vulnerability is fixed in 3.11.0.", "A flaw was found in vm2 (before 3.11.0). When the module builtin is allowed (including via wildcard), sandboxed code can call Module._load() in the host context, bypassing the builtin allowlist and loading excluded modules such as child_process for remote code execution. Fixed in 3.11.0." ],
  "statement" : "vm2 NodeVM is vulnerable to builtin allowlist bypass through the module builtin exposing host Module._load(). An attacker with low privileges who can execute sandboxed code when module is permitted may load excluded host builtins and achieve remote code execution. Fixed in vm2 3.11.0.",
  "affected_release" : [ {
    "product_name" : "Red Hat Ansible Automation Platform 2.1",
    "release_date" : "2026-08-05T00:00:00Z",
    "advisory" : "RHSA-2026:50850",
    "cpe" : "cpe:/a:redhat:ansible_portal:2.1",
    "package" : "ansible-automation-platform/automation-portal:1785854226"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Developer Hub",
    "fix_state" : "Not affected",
    "package_name" : "rhdh/rhdh-hub-rhel9",
    "cpe" : "cpe:/a:redhat:rhdh:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-43999\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43999\nhttps://github.com/patriksimek/vm2/security/advisories/GHSA-947f-4v7f-x2v8" ],
  "name" : "CVE-2026-43999",
  "csaw" : false
}