CVE-2026-92957 Details
Description
vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, negative wildcard entries are matched by exact string comparison against the canonical builtin names, so a policy such as `new NodeVM({ require: { builtin: ['*', '-node:child_process'] } })` fails to deny the canonical `child_process` module. Sandboxed code can therefore obtain the host `child_process` builtin via `require('child_process')` or `require('node:child_process')`, gaining references to process-spawning APIs such as execSync and spawn, which is equivalent to host command-execution capability for untrusted sandbox code. Fixed in vm2 3.11.7.
A vulnerability exists in vm2 versions through 3.11.6, where the NodeVM component does not properly normalize `node:`-prefixed built-in module specifiers when processing user-defined negative entries in a wildcard require policy. Although the `node:` prefix is removed during the resolution of require() calls, the negative entries are matched against the canonical module names through exact string comparison. This flaw allows sandboxed code to access the host `child_process` module by requiring either `child_process` or `node:child_process`, thereby gaining access to process-spawning functions like `execSync` and `spawn`. This is equivalent to allowing command execution in the host environment from untrusted sandboxed code.
Users are advised to update to vm2 version 3.11.7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/vm2-before-3.11.7-authentication-bypass-via-node-prefix | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vm2 | <= 3.11.6 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | CVE Modified | [email protected] |
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |