CVE-2026-92957 vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix
Attackers can bypass sandbox restrictions to execute arbitrary host commands by exploiting a flaw in the builtin module deny-list logic.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92957?
CVE-2026-92957 is a critical vulnerability in patriksimek vm2, published on 17 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, negative wildcard entries are matched by exact string comparison against the canonical builtin names, so a policy such as `new NodeVM({ require: { builtin: ['*', '-node:child_process'] } })` fails to deny the canonical `child_process` module. Sandboxed code can therefore obtain the host `child_process` builtin via `require('child_process')` or `require('node:child_process')`, gaining references to process-spawning APIs such as execSync and spawn, which is equivalent to host command-execution capability for untrusted sandbox code. Fixed in vm2 3.11.7.
Weakness: CWE-269
Which versions are affected by CVE-2026-92957?
2 open source packages ship an affected version, including vm2.
| Package | Affected | Fixed in |
|---|---|---|
vm2 npm | All versions | 3.11.7 |
vm2 npm | All versions | 3.11.7 |
How do I fix CVE-2026-92957?
Upgrade vm2 to 3.11.7 or later.
Is CVE-2026-92957 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92957 exists.
Sources
Also known as CLEANSTART-2026-VO63729, ECHO-62cc-9713-aaf7, GHSA-8686-vhfx-7r3j, MINI-fp9r-38jm-fgmv, ROOT-APP-NPM-CVE-2026-92957.