A denylist gap in vm2's NodeVM can let sandboxed code require child_process and run arbitrary commands on the host, carrying a CVSS v3.1 base score of 10.0; the top of that scale.
What Is It
vm2 NodeVM versions before 3.12.1 contain a sandbox escape. The library's DANGEROUS_BUILTINS denylist, the mechanism meant to keep guest code away from host-spawning capabilities, omits child_process while blocking other modules in that same class. Where the host application grants the sandbox broad access to built-in modules, code running inside the sandbox can therefore require('child_process') and execute arbitrary commands on the underlying host. Whether a given deployment is reachable depends on its builtin configuration; see What's Vulnerable below.
The record classifies the flaw as CWE-693 (Protection Mechanism Failure), which fits the shape of the bug as described: the control exists, it simply has a hole in it.
Why It Matters
The published base score is 10.0 (CRITICAL) under CVSS v3.1, with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That vector is a v3.1 string and cannot be read as a v4.0 assessment, CVSS v4.0 uses a different metric set (AV/AC/AT/PR/UI/VC/VI/VA/SC/SI/SA) with no scope metric, so any v4.0 rating for this CVE would be expressed separately and should not be inferred from the string above. In v3.1 terms: network attack vector, low attack complexity, no privileges, no user interaction, and high confidentiality, integrity, and availability impact. The changed scope reflects that the impact crosses out of vm2's own security authority onto the host process, the C/I/A ratings describe the impact on that impacted component, not a doubled impact on two components.
Note also that the v3.1 vector's low-complexity, no-precondition framing sits in tension with the configuration dependency described below; scores of this kind generally assume the permissive configuration is in play.
vm2 exists specifically to run untrusted code. Anywhere it is deployed, the threat model already assumes an adversary controls the guest program; so in a vulnerable configuration a sandbox escape converts more or less directly into remote code execution on the host, with little additional foothold or chaining required.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation and no federal remediation deadline associated with it at this time.
What's Vulnerable
- Package:
pkg:npm/vm2(vendor: patriksimek) - Affected: all versions
< 3.12.1 - Not affected:
3.12.1and later - Condition: exploitable when NodeVM is configured with
builtin: ['*']or withchild_processexplicitly allowed
Deployments that pass a restrictive, explicit builtin allowlist excluding child_process fall outside the described condition and are not believed to be exploitable by this path.
Patch Status
Upgrade to vm2 3.12.1 or later, which marks the affected range fixed. As an interim measure for anything that cannot be upgraded immediately, the described exploit condition points at configuration: replace builtin: ['*'] with a narrow explicit allowlist and remove any explicit child_process grant. Treat that as risk reduction against the documented path rather than an equivalent to the patch.
The CVE record was published 2026-09-18 with VulnCheck as the assigning CNA. Because the record is only hours old, it has not yet been through independent NVD analysis; the CVSS metrics and the CWE-693 assignment above are the CNA's own assessment as carried in the record, and the NVD entry's enrichment status may change as analysts review it.