CVE-2026-92948: vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test
vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the node:test builtin (e.g. require: { builtin: ['node:test'] }). On Node.js 24+, module.builtinModules exposes the scheme-only key node:test, which is not covered by vm2's family-based DANGEROUSBUILTINS protection, so it is stored in the generic host-passthrough loader. Because requireImpl() in lib/setup-node-sandbox.js strips a single 'node:' prefix before the builtin lookup, sandbox code calling require('node:node:test') resolves to the stored node:test key and receives a readonly proxy to the host module. Calls to node:test.run() are forwarded to the host implementation, which spawns a separate Node process for process-isolated test execution and passes through attacker-controlled execArgv values; supplying --eval=<JavaScript> therefore executes arbitrary JavaScript in an unrestricted host Node process outside the NodeVM sandbox. Fixed in vm2 3.11.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.7 - Compensating control
If you are using vm2 on Node.js 24+ and have an explicit require allowlist that includes builtin ['node:test'] (e.g., require: { builtin: ['node:test'] }), remove/avoid allowing the node:test builtin to prevent the sandbox escape described for vm2 versions >= 3.9.6 and <= 3.11.6.
Event History
Frequently Asked Questions
Which deployments are exposed to this escape path?
The affected path requires Node.js 24 or newer and a NodeVM configuration that explicitly permits the node:test builtin, such as require: { builtin: ['node:test'] }. Deployments that do not allow node:test are not exposed through this specific bypass.
What access does an attacker need to exploit it?
An attacker needs the ability to execute JavaScript inside the affected NodeVM sandbox. They can then require node:node:test and supply attacker-controlled execArgv to node:test.run() to execute JavaScript in an unrestricted host Node process.
Is a default NodeVM builtin configuration affected?
This issue depends on the embedder explicitly allowlisting node:test. The described bypass does not apply unless that builtin has been enabled.
What can be done before upgrading?
Remove node:test from the NodeVM builtin allowlist. The described exploit path also requires Node.js 24 or newer, so environments not running Node.js 24+ are not affected by this specific condition; upgrade vm2 to 3.11.7 when possible.
How can I identify vulnerable configurations?
Identify vm2 installations from 3.9.6 through 3.11.6 running on Node.js 24 or newer, then review NodeVM require.builtin settings for node:test. Also search sandboxed code for require('node:node:test') and calls to node:test.run() with controlled execArgv values.