Skip to content
Threat Feed
Subscribe
critical advisory PoC

Sandbox Escape in vm2 via NodeVM Configuration Misvalidation

An improper validation of the 'require' configuration in the vm2 Node.js sandbox allows attackers to bypass nesting restrictions and achieve arbitrary code execution by spawning an inner NodeVM with elevated privileges.

CVE search metadata

CVE search record: CVE-2026-92935. Severity: critical. CVSS: 9.0. EPSS: 0.67%. KEV: no. Product: vm2 (>= 3.11.4 and <= 3.11.6), vm2 (3.11.6), vm2 (3.11.3-3.11.6), vm2 (3.11.3 - 3.11.6), vm2 (3.10.2 - 3.11.6), vm2 (< 3.11.7), vm2 (>= 3.9.6, <= 3.11.6), vm2 (3.11.0-3.11.7), vm2 (3.10.1 - 3.11.6), vm2 (<= 3.11.6), vm2 (<= 3.12.0), vm2 (>= 3.11.4, <= 3.11.6). Brief: Sandbox Escape in vm2 via NodeVM Configuration Misvalidation. Brief link: https://feed.craftedsignal.io/briefs/2026-09-vm2-sandbox-escape/

CVE search record: CVE-2026-92944. Severity: critical. CVSS: 9.8. EPSS: 0.84%. KEV: no. Product: vm2 (>= 3.11.4 and <= 3.11.6), vm2 (3.11.6), vm2 (3.11.3-3.11.6), vm2 (3.11.3 - 3.11.6), vm2 (3.10.2 - 3.11.6), vm2 (< 3.11.7), vm2 (>= 3.9.6, <= 3.11.6), vm2 (3.11.0-3.11.7), vm2 (3.10.1 - 3.11.6), vm2 (<= 3.11.6), vm2 (<= 3.12.0), vm2 (>= 3.11.4, <= 3.11.6). Brief: Sandbox Escape in vm2 via NodeVM Configuration Misvalidation. Brief link: https://feed.craftedsignal.io/briefs/2026-09-vm2-sandbox-escape/

CVE search record: CVE-2026-92946. Severity: critical. CVSS: 10.0. EPSS: 0.86%. KEV: no. Product: vm2 (>= 3.11.4 and <= 3.11.6), vm2 (3.11.6), vm2 (3.11.3-3.11.6), vm2 (3.11.3 - 3.11.6), vm2 (3.10.2 - 3.11.6), vm2 (< 3.11.7), vm2 (>= 3.9.6, <= 3.11.6), vm2 (3.11.0-3.11.7), vm2 (3.10.1 - 3.11.6), vm2 (<= 3.11.6), vm2 (<= 3.12.0), vm2 (>= 3.11.4, <= 3.11.6). Brief: Sandbox Escape in vm2 via NodeVM Configuration Misvalidation. Brief link: https://feed.craftedsignal.io/briefs/2026-09-vm2-sandbox-escape/

CVE search record: CVE-2026-92942. Severity: high. CVSS: 7.5. EPSS: 0.49%. KEV: no. Product: vm2 (>= 3.11.4 and <= 3.11.6), vm2 (3.11.6), vm2 (3.11.3-3.11.6), vm2 (3.11.3 - 3.11.6), vm2 (3.10.2 - 3.11.6), vm2 (< 3.11.7), vm2 (>= 3.9.6, <= 3.11.6), vm2 (3.11.0-3.11.7), vm2 (3.10.1 - 3.11.6), vm2 (<= 3.11.6), vm2 (<= 3.12.0), vm2 (>= 3.11.4, <= 3.11.6). Brief: Sandbox Escape in vm2 via NodeVM Configuration Misvalidation. Brief link: https://feed.craftedsignal.io/briefs/2026-09-vm2-sandbox-escape/

CVE search record: CVE-2026-92958. Severity: high. CVSS: 8.5. EPSS: 0.38%. KEV: no. Product: vm2 (>= 3.11.4 and <= 3.11.6), vm2 (3.11.6), vm2 (3.11.3-3.11.6), vm2 (3.11.3 - 3.11.6), vm2 (3.10.2 - 3.11.6), vm2 (< 3.11.7), vm2 (>= 3.9.6, <= 3.11.6), vm2 (3.11.0-3.11.7), vm2 (3.10.1 - 3.11.6), vm2 (<= 3.11.6), vm2 (<= 3.12.0), vm2 (>= 3.11.4, <= 3.11.6). Brief: Sandbox Escape in vm2 via NodeVM Configuration Misvalidation. Brief link: https://feed.craftedsignal.io/briefs/2026-09-vm2-sandbox-escape/

CVE search record: CVE-2026-93604. Severity: high. CVSS: 7.2. EPSS: 0.34%. KEV: no. Product: vm2 (>= 3.11.4 and <= 3.11.6), vm2 (3.11.6), vm2 (3.11.3-3.11.6), vm2 (3.11.3 - 3.11.6), vm2 (3.10.2 - 3.11.6), vm2 (< 3.11.7), vm2 (>= 3.9.6, <= 3.11.6), vm2 (3.11.0-3.11.7), vm2 (3.10.1 - 3.11.6), vm2 (<= 3.11.6), vm2 (<= 3.12.0), vm2 (>= 3.11.4, <= 3.11.6). Brief: Sandbox Escape in vm2 via NodeVM Configuration Misvalidation. Brief link: https://feed.craftedsignal.io/briefs/2026-09-vm2-sandbox-escape/

What's new

  • 1. added CVE-2026-92935 +4 Oct 6, 00:44 via ghsa
  • 2. added coverage for vm2 (<= 3.11.6) Oct 1, 20:22 via ghsa
  • 3. poc_available; added CVE-2026-92938 +5 Oct 1, 20:20 via ghsa
  • 4. added coverage for vm2 (<= 3.12.0) Sep 18, 18:06 via nvd
  • 5. added coverage for vm2 (<= 3.12.0) Sep 18, 16:07 via nvd

The vm2 library, commonly used as a sandbox for executing untrusted Node.js code, contains a critical vulnerability (CVE-2026-92935) in its NodeVM constructor logic. In versions 3.11.4 through 3.11.6, the hasRealRequireConfig check fails to correctly validate the require option when provided as an array. Specifically, passing an array-shaped require object satisfies the guard meant to reject nesting without explicit configuration.

This logic flaw allows an attacker to manipulate the makeResolverFromLegacyOptions() function, leading to the creation of a resolver that exposes the host's vm2 module. By supplying a payload that initiates a NodeVM with nesting: true and a malicious require array, an attacker can escape the sandbox boundaries. Once escaped, the attacker can create an inner NodeVM with arbitrary builtin privileges, such as child_process, enabling the execution of arbitrary commands under the context of the host Node.js process. This vulnerability is addressed in vm2 version 3.11.7.

Impact

Successful exploitation allows for full sandbox escape and arbitrary code execution within the host environment. This impacts any application relying on vm2 for isolation of untrusted JavaScript, potentially leading to unauthorized data access, system-level command execution, and full compromise of the Node.js application process.

Recommendation

  • Upgrade the vm2 dependency to version 3.11.7 or later across all applications utilizing this library to mitigate CVE-2026-92935.
  • Audit all application code utilizing the NodeVM constructor to ensure the require configuration is strictly defined as an object rather than an array.
  • Implement process-level sandboxing (e.g., containers, gVisor) as a secondary defense layer to limit the impact of a potential sandbox escape.

Immediate actions

Upgrade all instances of vm2 to version 3.11.7.

Development 48h

Mitigations

Upgrade to vm2 3.11.7.

immediate IT Operations

CVE-2026-92935