EUVD-2026-81599
GHSA-hc6q-4vvg-jf79
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious script using require(__filename)
-
DeliveryVictim runs vm2 CLI on file
-
ExploitScript re-executes in host realm
-
ExecutionLoad host fs/child_process
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires the vm2 CLI tool specifically to be invoked against an attacker-controlled script file - the vulnerable path is the CLI, not the library's programmatic VM/NodeVM API. The limiting factors are significant: the attack vector is local (AV:L), a user or automated job must actively run the CLI on the malicious file (UI:P), and the environment must be running vm2 before 3.11.7. There is no remote or network-facing trigger; the flaw only matters where untrusted JavaScript is passed to the vm2 command-line utility, which is a narrower deployment pattern than server-side sandbox usage. |
| Impact | The vendor CVSS 4.0 vector (9.3) rates this critical, but the vector itself reveals why real-world risk is materially lower than the network-facing vm2 escapes in this same wave: AV:L (local attack vector) plus UI:P (passive user interaction) mean exploitation requires a victim to run the vm2 CLI tool against an attacker-supplied malicious script file. This is not a remote, unauthenticated, service-facing flaw - it is a 'who runs the vm2 CLI over untrusted code' scenario, i.e. the vm2 threat model applied to a developer/utility surface rather than a production server endpoint. Technical impact is genuine and severe once triggered (full host RCE via require(__filename) re-executing in the host realm, reaching fs/child_process). Exploitation status: no public exploit identified in the input, though proof-of-concept detail is likely present in the GHSA/VulnCheck advisory; not in CISA KEV and no EPSS score supplied - treat as no confirmed active exploitation. Note the CWE assignment (CWE-453, Insecure Default Variable Initialization) is a poor fit for a sandbox-escape/RCE and should not be relied upon for triage. Net: real but conditional - prioritize where the vm2 CLI is invoked on untrusted input; deprioritize relative to the default-config network escapes. |
| Exploit ScenarioDerived | A developer or automated pipeline uses the vm2 CLI to 'safely' evaluate an untrusted JavaScript file. The attacker crafts that file to call require(__filename), which re-executes the script in the host Node.js realm outside the sandbox, giving it access to host modules like fs and child_process and thus arbitrary code execution as the CLI process. No public exploit is named in the data, but the technique is fully described in the advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Sandbox escape in the vm2 Node.js sandboxing library before 3.11.7 lets an attacker who supplies a malicious script file to the vm2 command-line tool execute arbitrary code in the host Node.js process, gaining access to host modules such as fs and child_process. The vulnerable entry point is the CLI utility specifically, not the library's programmatic VM/NodeVM API: an attacker-crafted script uses require(__filename) to re-execute itself in the host realm and slip past the sandbox membrane. Exploitation is local rather than network-facing (CVSS 4.0 AV:L/UI:P, PR:N), requiring a victim or automated job to invoke the vm2 CLI against the attacker-controlled file; the vendor rating is 9.3 (critical), but the local vector and required user interaction make real-world exposure materially narrower than the network-facing vm2 escapes, and there is no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade vm2 to 3.11.7 or later, which fixes the CLI host-realm breakout; apply the update per the GitHub advisory GHSA-jxxv-8r27-vm4p (https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p) and verify with npm ls vm2 that no transitive dependency still pins an older release. Where immediate upgrading is not possible, stop feeding untrusted or externally supplied JavaScript to the vm2 CLI (the affected surface) and, if sandboxing is still required, call the programmatic VM/NodeVM API instead, which is not impacted by this CLI-specific flaw; treat any script file as fully privileged input in the meantime. Additional compensating controls, each with trade-offs: run the vm2 CLI as an unprivileged, non-root user with a hardened filesystem namespace so a breakout cannot touch sensitive host files (reduces blast radius but does not prevent code execution); execute the CLI inside a container or VM with seccomp/AppArmor confinement and no network egress (blocks host fs/child_process abuse but adds operational overhead and may break legitimate scripts); and restrict who can place files that the CLI consumes, since exploitation requires a victim or scheduled job to invoke the tool on the attacker-controlled file, with UI:P making social-engineering or supply-chain delivery the practical trigger. Detection should focus on CLI invocations of vm2 against files originating from untrusted sources, and on child_process spawning or unexpected fs access from processes that normally only run sandboxed snippets.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vm2 is a widely used Node.js sandbox library that isolates untrusted JavaScript inside a separate V8 context using Proxy-based membranes, wrapping host objects so that guest code cannot reach host prototypes or native modules. CVE-2026-92950 is rooted in CWE-453 (Insecure Default Variable Initialization): in vm2 before 3.11.7, the bundled CLI wrapper initializes its script-loading context in a way that exposes the host-side filename/host realm references, so a script passed on the command line can call require(__filename) to re-load and re-execute itself outside the sandbox, escalating from guest code to the parent Node.js process where fs and child_process are reachable. This is a host-realm breakout rather than a within-sandbox JS escape, and it is confined to the CLI code path in the patriksimek:vm2 package; applications that embed the library and call the VM/NodeVM APIs directly are not the vulnerable surface. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, high confidentiality/integrity/availability on both vulnerable and subsequent systems) reflects a local, unauthenticated precondition where the victim is induced to run the CLI on a hostile file; the independent assessment concurs with a CVSS 3.1 equivalent of AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
Know when Vm2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CLI runs on a local attacker-supplied file so AV:L and UI:R; escape crosses the sandbox trust boundary into the host process (S:C) yielding full host RCE (C/I/A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.
Technical POC Analysis
CWE-453 (also CWE-829/CWE-1188 per advisory): bin/vm2:3 - lib/cli.js:7-18 calls NodeVM.file(path, { verbose: true, require: { external: true } }) without require.root, require.context, or require.bui…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A critical sandbox-escape flaw in the vm2 Node.js sandboxing library (CVE-2026-92950) allows a malicious script file processed by the vm2 command-line tool to break out of the sandbox and run arbitrary code inside the host Node.js process, reaching sensitive host modules such as fs and child_process. Because vm2 is typically embedded in CI/CD pipelines, build agents, and internal automation platforms, a single untrusted or attacker-supplied script could compromise the credentials, source code, and network access available to those systems. The attack is local and requires an operator or automated job to invoke the CLI against the crafted file, and no public exploit has been identified, so exposure is narrower than a network-facing flaw, but the absence of a vendor patch makes this a priority for teams that process untrusted scripts in shared or privileged environments.
No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis. Interim mitigations: stop invoking the vm2 CLI against untrusted or externally sourced script files; remove or disable the CLI entry point from CI/CD pipelines and shared automation hosts; run any remaining usage inside a disposable, least-privilege container with no host filesystem mounts, no host credentials or cloud tokens, and no network egress; apply OS-level sandboxing and seccomp profiles; restrict who can submit scripts; monitor and alert on unexpected host-module access or self-re-execution behavior; and migrate to an alternative isolation mechanism such as isolated-vm, Node.js worker threads with permission restrictions, or a hardened container boundary.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
vm2 is an advanced vm/sandbox for Node.js. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitab
vm2 is a sandbox that can run untrusted code with Node's built-in modules. Rated critical severity (CVSS 10.0), this vul
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Rated critical severity (CVSS 10.
There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15,
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Rated critical severity (CVSS 10.
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Full sandbox escape with arbitrary code execution allows remote attackers to break out of vm2's Node.js sandbox environm
Sandbox escape in vm2 for Node.js allows remote unauthenticated attackers to execute arbitrary commands on the host syst
Sandbox escape in vm2 (patriksimek/vm2) versions prior to 3.11.3 enables remote code execution on the host Node.js proce
Sandbox escape in vm2 Node.js sandbox before 3.10.2 via Promise.prototype.then/catch callback sanitization bypass. PoC a
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Rated critical severity (CVSS 9.8
The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the We
Exploit-DB