CVE-2026-93605: vm2 NodeVM before 3.12.1 Remote Code Execution via child_process
vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUSBUILTINS denylist omits childprocess despite blocking other host-spawning modules. Attackers can require childprocess and execute arbitrary commands on the host system when NodeVM is configured with builtin:[''] or explicit childprocess allowance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2 NodeVMto a version that resolves this vulnerability.Fixed in 3.12.1 - Configuration
Configure NodeVM builtin list to exclude child_process; avoid vm2 NodeVM configurations where builtin is set to ['*'] or where child_process is explicitly allowed.
vm2 NodeVM builtin = deny child_process (do not include '*' and do not explicitly allow child_process)
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
NodeVM deployments using vm2 versions before 3.12.1 are exposed when their builtin configuration uses builtin:['*'] or explicitly permits child_process. The issue affects environments that execute attacker-controlled or otherwise untrusted code in that NodeVM sandbox.
What does an attacker need to exploit it?
An attacker needs the ability to run code within an affected NodeVM instance configured to allow all built-ins or child_process specifically. No privileges or user interaction are required according to the supplied vector.
What is the impact of successful exploitation?
An attacker can require child_process from the sandbox and execute arbitrary commands on the host system. This can result in complete compromise of host confidentiality, integrity, and availability.
How can I determine whether an instance is affected?
Check whether NodeVM uses a vm2 version earlier than 3.12.1, then review its builtin configuration. Instances with builtin:['*'] or an explicit child_process entry are affected configurations.