CVE-2026-92935: vm2 NodeVM Remote Code Execution via Array-Shaped Require
vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes hasRealRequireConfig with typeof requireOpts === 'object' && requireOpts !== null, so an array-shaped require value (for example require: []) satisfies the guard that is meant to reject nesting without an explicit require configuration. makeResolverFromLegacyOptions() then destructures the array into undefined option fields and returns a resolver containing only NESTINGOVERRIDE.vm2. As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy nesting and an array-shaped require (e.g. new NodeVM({nesting: true, require: []})) can require the host vm2 module, create an inner NodeVM with an attacker-chosen builtin allowlist (such as childprocess), and execute arbitrary commands with the privileges of the host Node.js process, escaping the sandbox. Outer builtin restrictions do not constrain the attacker-created inner NodeVM. This issue is fixed in vm2 3.11.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.7
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using vm2 versions 3.11.4 through 3.11.6 are exposed when they execute attacker-supplied JavaScript in a NodeVM configured with truthy nesting and an array-shaped require value, such as require: [].
What does an attacker need to exploit the vulnerability?
The attacker must be able to provide JavaScript that is executed by the affected NodeVM. Exploitation also requires the NodeVM configuration to enable nesting and use an array-shaped require setting.
Do outer builtin restrictions prevent exploitation?
No. The attacker can load the host vm2 module, create an inner NodeVM with an attacker-selected builtin allowlist, and use that inner VM to access capabilities such as child_process.
What is the remediation?
Upgrade vm2 to version 3.11.7, which fixes the issue. If upgrading is not immediately possible, do not run untrusted code in NodeVM instances that combine truthy nesting with an array-shaped require value.
How can I identify potentially affected configurations?
Review NodeVM construction code for vm2 3.11.4 through 3.11.6 and look for truthy nesting together with require set to an array, including require: [].