Remote Code Execution Risk in vm2 Sandbox for Node.js by Patrik Simek

CVE-2026-92935

What is CVE-2026-92935?

The vm2 sandbox, utilized for executing untrusted Node.js code, has a vulnerability in versions 3.11.4 through 3.11.6 that allows attackers to escape the sandbox environment. This issue arises when the NodeVM constructor incorrectly evaluates requireOpts, permitting an attacker to provide an array-shaped require value. If an attacker configures a NodeVM with nesting set to true and an array for the require option, they can gain access to the host vm2 module. This leads to the creation of another inner NodeVM with arbitrary configurations, allowing execution of commands with the host process's privileges. The vulnerability is addressed in vm2 version 3.11.7.

References