CVE-2026-93605: vm2 Sandbox Escape Vulnerability Allows Host Command Execution
Summary
CVE-2026-93605: vm2 contains a sandbox escape vulnerability. Affects vm2 versions < 3.12.1. Fixed in 3.12.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js module that provides a sandboxed environment for executing untrusted JavaScript code. It allows developers to run scripts in a controlled manner, preventing access to the host system's resources. However, a critical vulnerability has been discovered in versions prior to 3.12.1, which can lead to a sandbox escape, allowing attackers to execute arbitrary commands on the host system.
Vulnerability Detail
The vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability due to the omission of 'child_process' from the DANGEROUS_BUILTINS denylist. This allows attackers to require 'child_process' and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or when 'child_process' is explicitly allowed. The vulnerability arises from an inconsistency in the denylist, which blocks other host-spawning modules but fails to include 'child_process', the most direct command-execution primitive. As a result, a sandbox running under the vulnerable configurations can lead to full host remote code execution (RCE).
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.12.1
This is the first release that contains the fix.
npm install vm2@3.12.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, avoid using the configuration that allows 'child_process' or 'builtin:['*']'. Instead, restrict the builtins to only those necessary for your application. For example, you can configure NodeVM as follows:
const { NodeVM } = require('vm2');
const vm = new NodeVM({ require: { builtin: ['fs'] } });
Conclusion
The vm2 package has a critical vulnerability that allows for sandbox escape and arbitrary command execution on the host system. It is essential to update to version 3.12.1 or later to mitigate this risk. If immediate updates are not possible, restricting the builtins in your NodeVM configuration can serve as a temporary workaround.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 10.0, indicating a critical level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
The vulnerability allows attackers to execute arbitrary commands on the host system, leading to a complete sandbox escape and potential compromise of the host environment.
Yes, version 3.12.1 and later of vm2 have patched this vulnerability and are safe to use.
If you cannot update the package, ensure that your NodeVM configuration does not allow 'child_process' or use the wildcard 'builtin:['*']'. Restrict builtins to only those necessary for your application.
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
