vm2 Vulnerability in NodeVM Affecting Host Command Execution

CVE-2026-92957

What is CVE-2026-92957?

The vm2 package versions prior to 3.11.7 exhibit a vulnerability where user-supplied negative entries in a NodeVM wildcard require policy fail to adequately deny access to Node.js built-in modules. Specifically, the presence of the node: prefix in deny-list entries does not normalize properly, which allows malicious payloads to require modules like child_process, granting unauthorized access to significant process-spawning capabilities. This poses serious risks as it enables untrusted code to execute host commands through standard Node.js APIs. The vulnerability highlights the critical need for stringent sandboxing within NodeVM configurations to prevent exploitation.

References