CVE-2026-93604 vm2 3.11.8 Sandbox Escape via crypto.setFips
Attackers can bypass sandbox isolation in vm2 by calling crypto.setFips if the crypto builtin is explicitly allowlisted, altering host process state.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-93604?
CVE-2026-93604 is a medium-severity vulnerability in patriksimek vm2, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM (require.builtin: ['crypto']). The builtin sanitizer (sanitizeCryptoModule in lib/builtin.js) replaces crypto.setEngine but leaves crypto.setFips callable, and the readonly wrapper used to expose the host module does not localize side effects of forwarded host functions. Guest code can therefore call crypto.setFips() to change the FIPS mode of the entire host process; the modified mode is subsequently observed by trusted host code (crypto.getFips() changed from 0 to 1 in the reported test), crossing the NodeVM isolation boundary. Fixed in vm2 3.12.1.
Weakness: CWE-284
Which versions are affected by CVE-2026-93604?
How do I fix CVE-2026-93604?
No fix has been published for CVE-2026-93604 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-93604 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93604 exists.
Sources
Also known as GHSA-qrp3-78q3-75rc, GHSA-x3v6-43hc-82mc.