When NodeVM is initialized with a configuration that allows built-in modules - specifically via the builtin:['*'] setting or explicit child_process inclusion - the sandbox fails to enforce boundaries. An attacker capable of injecting or controlling the code executed within the NodeVM instance can invoke child_process to interact with the underlying host operating system. This vulnerability enables arbitrary command execution with the privileges of the Node.js process, potentially leading to full system compromise depending on the container or host permissions. Organizations using vm2 to execute untrusted user input must upgrade to version 3.12.1 or later to ensure the denylist is correctly enforced.

Impact

Successful exploitation of this vulnerability results in arbitrary remote code execution (RCE) on the host machine hosting the Node.js application. This poses a critical risk to any environment relying on vm2 for server-side code sandboxing, potentially allowing attackers to exfiltrate sensitive files, pivot within the network, or deploy persistent malware.

Recommendation

• Upgrade the vm2 library to version 3.12.1 or higher immediately to apply the patch for CVE-2026-93605.
• Audit applications utilizing vm2 to determine if NodeVM is configured with built-in modules enabled.
• Implement defense-in-depth measures by running sandboxed Node.js processes in containers with restricted syscalls and minimal filesystem access to limit the impact of potential escapes.
• Transition away from vm2 if possible, as the library has historically faced multiple sandbox escape vulnerabilities.