cyfenced.com →

[ CVE-2026-93605 · Published 18 Sep 2026 ]

vm2 contains a sandbox escape vulnerability

CVSS 10.0 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Critical severity: CVSS 10.0

[ Description ]Official description

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.

[ Fixes ]Fixes and patches

  • vm2 3.12.1Fixed version · GitHub Advisories · npm package vm2: upgrade to 3.12.1 or later (affected <= 3.12.0)

[ Packages ]Affected open-source packages

[ References ]References