A critical (CVSS 9.9) flaw in the vm2 JavaScript sandbox lets untrusted code inside a NodeVM break out and execute arbitrary JavaScript in an unrestricted host Node.js process.
What Is It
vm2 from version 3.9.6 through the last unpatched 3.11.x release contains a NodeVM builtin allowlist bypass that permits a full sandbox escape on Node.js 24 and newer, when the embedder explicitly allows the node:test builtin (for example, require: { builtin: ['node:test'] }).
On Node.js 24+, module.builtinModules exposes the scheme-only key node:test. That key is not covered by vm2's family-based DANGEROUS_BUILTINS protection, so it lands in the generic host-passthrough loader. Because requireImpl() in lib/setup-node-sandbox.js strips a single node: prefix before the builtin lookup, sandbox code calling require('node:node:test') resolves to the stored node:test key and receives a readonly proxy to the host module.
Calls to node:test.run() are forwarded to the host implementation, which spawns a separate Node process for process-isolated test execution and passes through attacker-controlled execArgv values. Supplying --eval=<JavaScript> therefore executes arbitrary JavaScript in an unrestricted host Node process, outside the NodeVM sandbox. NVD classifies the issue as CWE-693 (Protection Mechanism Failure).
Why It Matters
Per NVD, the CVSS 3.1 base score is 9.9 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network attack vector, low complexity, low privileges required, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact. NVD also assigns a CVSS 4.0 score of 9.4 (CRITICAL). vm2 exists specifically to contain untrusted code; a reliable escape collapses that boundary entirely and hands the attacker host-level code execution.
There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor/product: patriksimek / vm2 (
pkg:npm/vm2) - Affected versions: 3.9.6 up to, but not including, the fixed 3.11.x release. Sources disagree on where that range ends: the VulnCheck advisory gives 3.9.6 through 3.11.5 (implying a fix in 3.11.6), while the GitHub Security Advisory data used for this brief gives
< 3.11.7(implying a fix in 3.11.7). Verify against the advisories below before relying on a specific cutoff. - Unaffected: the fixed 3.11.x release and later, 3.11.7 per GHSA, 3.11.6 per VulnCheck
- Precondition: Node.js 24 or newer, with the embedder explicitly allowing the
node:testbuiltin
Patch Status
A fix is available in the 3.11.x line; because the two advisories disagree on which release carries it, upgrade to the latest published vm2 3.11.x release (3.11.7 or later satisfies both readings). Where upgrading is not immediately possible, the escape depends on node:test being present in the embedder's builtin allowlist; per the advisory data, that configuration is the stated precondition for exploitation.
Sources
- vm2 GitHub Security Advisory GHSA-qhwx-74w5-xhxq; https://github.com/patriksimek/vm2/security/advisories/GHSA-qhwx-74w5-xhxq
- VulnCheck Advisory: vm2 sandbox escape via node:test; https://www.vulncheck.com/advisories/vm2-3.9.6-through-3.11.5-sandbox-escape-via-node-test
- NVD entry for CVE-2026-92948 (CVSS 3.1/4.0 scoring, CWE-693), https://nvd.nist.gov/vuln/detail/CVE-2026-92948