CVE-2026-92935

Summary

vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes hasRealRequireConfig with typeof requireOpts === 'object' && requireOpts !== null, so an array-shaped require value (for example require: []) satisfies the guard that is meant to reject nesting without an explicit require configuration. makeResolverFromLegacyOptions() then destructures the array into undefined option fields and returns a resolver containing only NESTING_OVERRIDE.vm2. As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy nesting and an array-shaped require (e.g. new NodeVM({nesting: true, require: []})) can require the host vm2 module, create an inner NodeVM with an attacker-chosen builtin allowlist (such as child_process), and execute arbitrary commands with the privileges of the host Node.js process, escaping the sandbox. Outer builtin restrictions do not constrain the attacker-created inner NodeVM. This issue is fixed in vm2 3.11.7.

Affected Software

Weaknesses

• CWE-913: Improper Control of Dynamically-Managed Code Resources

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://github.com/patriksimek/vm2/security/advisories/GHSA-8hr7-r645-pc6w
• https://github.com/patriksimek/vm2/commit/54b54b74a382577f0bcd0538c5bf99acdcd7f53b
• https://www.vulncheck.com/advisories/vm2-nodevm-remote-code-execution-via-array-shaped-require

• ←Previous
• Next→