CVE-2026-92957: vm2 before 3.11.7 Authentication Bypass via node: Prefix
vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the node: prefix during require() resolution, negative wildcard entries are matched by exact string comparison against the canonical builtin names, so a policy such as new NodeVM({ require: { builtin: ['', '-node:childprocess'] } }) fails to deny the canonical childprocess module. Sandboxed code can therefore obtain the host childprocess builtin via require('childprocess') or require('node:childprocess'), gaining references to process-spawning APIs such as execSync and spawn, which is equivalent to host command-execution capability for untrusted sandbox code. Fixed in vm2 3.11.7. (Suggested title: "vm2 before 3.11.7: NodeVM builtin deny-list bypass via node:-prefixed specifiers exposes childprocess")
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.7 - Configuration
Ensure the deny list correctly blocks the canonical builtin name 'child_process' (not only 'node:child_process'). In affected vm2 versions through 3.11.6, negative wildcard entries are matched by exact string comparison and do not normalize 'node:'-prefixed specifiers, so '-node:child_process' may not deny 'child_process'.
vm2 NodeVM require builtin wildcard policy require.builtin = ['*', '-node:child_process']
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using NodeVM with a wildcard builtin require policy that attempts to deny a builtin using a node:-prefixed negative entry are exposed. For example, ['*', '-node:child_process'] does not block access to the canonical child_process builtin.
What does an attacker need to exploit the bypass?
An attacker needs the ability to run untrusted code in the affected NodeVM sandbox. That code can call require('child_process') or require('node:child_process') to obtain process-spawning APIs.
Are default configurations affected?
The issue affects the described wildcard allow policy combined with node:-prefixed deny entries. The provided information does not establish that configurations without this policy pattern are affected.
What should be done if upgrading cannot happen immediately?
Do not rely on node:-prefixed negative builtin entries to restrict sandboxed code. Remove wildcard builtin access or ensure sensitive builtins such as child_process are not available through the NodeVM require policy until vm2 3.11.7 can be deployed.
How can I identify a vulnerable policy?
Review NodeVM require.builtin settings for wildcard entries together with exclusions such as '-node:child_process'. On affected versions through 3.11.6, test whether sandboxed code can successfully require child_process despite that exclusion.