p PatchFirst

CVE-2026-92950

CVE-2026-92950 · vm2 before 3.11.7 Sandbox Escape via CLI require

This page contains facts from public vulnerability sources. Check the original advisory before updating.

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.

CVSS 9.3 · Critical · EPSS 0.2% · Public exploit · Fix available

Published
Updated

Stack: node

Affected products and versions

  • vm2

    Versions
    • ≥ 0, < 3.11.7: Affected (semver)
    • 3.11.7: Not affected (semver)

    Update to 3.11.7

  • vm2 npm

    Affected ranges
    • SEMVER: < 3.11.7

    Update to 3.11.7

Original sources

Check your server →