CVE-2026-92958 Details
Description
vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries (e.g. require: { builtin: ['*', '-fs', '-child_process'] }), negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the builtin named fs and does not remove builtin subpaths such as fs/promises. Sandboxed code can therefore call require('fs/promises') or require('node:fs/promises') and reach the promise-based filesystem API despite fs being denied; node: prefix handling is likewise inconsistent (a -node:fs/promises entry does not block require('fs/promises')). Host file creation and writing were confirmed via fsp.writeFile(), and other fs/promises operations (cp, mkdir, rename, rm, rmdir, truncate, read operations, etc.) are also reachable. This issue is fixed in vm2 3.11.7.
A denylist bypass vulnerability has been identified in vm2 versions through 3.11.6, specifically within the NodeVM component. The issue arises when the embedder utilizes the builtin wildcard alongside negative entries to restrict access to certain modules. In this scenario, negative entries are only effective against exact module names, allowing access to submodules that should be restricted. As a result, sandboxed code can access the promise-based filesystem API through 'fs/promises' or 'node:fs/promises', despite 'fs' being denied. This vulnerability has been confirmed to allow file creation and writing on the host filesystem, using 'fsp.writeFile()' as a proof of concept. Other 'fs/promises' operations, such as 'cp', 'mkdir', 'rename', 'rm', 'rmdir', 'truncate', and various read operations, are also accessible.
Users can upgrade to vm2 version 3.11.7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/patriksimek/vm2/security/advisories/GHSA-6rh5-qq4q-97xh | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-6rh5-qq4q-97xh | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/vm2-before-3.11.7-denylist-bypass-via-fs-promises | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vm2 | <= 3.11.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |