Sandbox Escape Vulnerability in vm2 by Patrik Simek
CVE-2026-93604

6.9MEDIUM

Key Information:

Vendor

Patriksimek

Status
Vm2
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93604?

The vm2 library versions up to 3.12.0 contain a vulnerability that allows untrusted guest code to manipulate the FIPS mode of the host Node.js process through the crypto.setFips() function. When the crypto module is allowlisted in a NodeVM, guest code can exploit this oversight to modify the FIPS mode, leading to potential unauthorized access and security breaches. This vulnerability disrupts the expected isolation provided by NodeVM and could affect the integrity of applications relying on FIPS-compliant cryptographic operations. The issue has been resolved in version 3.12.1 of vm2.

Affected Version(s)

vm2 0 < 3.12.1

vm2 3.12.1

References

https://github.com/patriksimek/vm2/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/vm2-3.11.8-sandbox-e...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

rexpository
manus-use
.