CVE-2026-92958: vm2 before 3.11.7 Denylist Bypass via fs/promises
vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries (e.g. require: { builtin: ['', '-fs', '-childprocess'] }), negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the builtin named fs and does not remove builtin subpaths such as fs/promises. Sandboxed code can therefore call require('fs/promises') or require('node:fs/promises') and reach the promise-based filesystem API despite fs being denied; node: prefix handling is likewise inconsistent (a -node:fs/promises entry does not block require('fs/promises')). Host file creation and writing were confirmed via fsp.writeFile(), and other fs/promises operations (cp, mkdir, rename, rm, rmdir, truncate, read operations, etc.) are also reachable. This issue is fixed in vm2 3.11.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.7
Event History
Frequently Asked Questions
Which deployments are exposed?
NodeVM deployments using a builtin wildcard with negative builtin entries are exposed when they attempt to deny fs, such as require: { builtin: ['*', '-fs', '-child_process'] }. The issue affects vm2 through 3.11.6.
What must an attacker be able to do?
An attacker must be able to run code inside the affected NodeVM sandbox. That code can request fs/promises or node:fs/promises to access the promise-based filesystem API despite the fs deny entry.
What could successful exploitation allow?
Host file creation and writing using fsp.writeFile() were confirmed. Other reachable fs/promises operations include copy, directory creation, rename, removal, truncation, and read operations.
How can this be remediated?
Upgrade vm2 to version 3.11.7, which fixes the issue. Negative entries for fs or node:fs/promises do not reliably block the alternate fs/promises module paths in affected versions.