CVE-2026-92950: vm2 before 3.11.7 Sandbox Escape via CLI require
vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and childprocess.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the vm2 CLI with versions before 3.11.7 are exposed when they execute an attacker-supplied script file. The issue affects the CLI execution path rather than being described as a general sandbox escape for all vm2 usage.
What must an attacker do to exploit it?
The attacker must cause a malicious script file to be supplied to and executed by the vm2 CLI. The script uses require(__filename) to re-execute in the host Node.js realm, where it can access host modules including fs and child_process.
What is the impact after successful exploitation?
Successful exploitation permits arbitrary code execution in the host Node.js process. This bypasses the intended sandbox isolation and can expose confidentiality, integrity, and availability of the host environment.
What version remediates the issue?
Update vm2 to version 3.11.7 or later. Versions before 3.11.7 are affected.