Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2026-93605

vm2 NodeVM before 3.12.1 Remote Code Execution via child_process

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

patriksimek vm2

Default version status: unaffected

  • 0 to < 3.12.1affected
  • 3.12.1unaffected
pkg:npm/vm2

References