CVE-2026-92955: vm2 before 3.11.8 Sandbox Escape via NodeVM
vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host proto getter/setter through console.stdout and console.stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2/NodeVMto a version that resolves this vulnerability.Fixed in 3.11.8
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using vm2 versions before 3.11.8 are affected when they use NodeVM to run attacker-controlled or otherwise untrusted code. The issue enables sandboxed code to escape into the host process context.
Does exploitation require credentials or user interaction?
No. The supplied vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.
What is the impact after a successful escape?
An attacker can execute code with the host process context. The reported impact includes high confidentiality, integrity, and availability effects, with scope changed beyond the sandbox.
What version should be used to remediate the issue?
Upgrade vm2 to version 3.11.8 or later. Versions before 3.11.8 are identified as affected.