CVE-2026-92955: vm2 Sandbox Escape Vulnerability
Summary
CVE-2026-92955: vm2: Sandbox Escape (NodeVM). Affects vm2 versions < 3.11.8. Fixed in 3.11.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js package that provides a sandboxed environment for executing untrusted code securely. It allows developers to run JavaScript code in a controlled manner, preventing access to the host environment. However, a critical vulnerability has been identified that allows attackers to escape this sandbox, potentially leading to unauthorized access to the host system.
Vulnerability Detail
The vulnerability arises from the ability to access the host 'proto' getter/setter through the console._stdout and console._stderr objects. This can be exploited to overwrite the EventEmitter.prototype.emit method, allowing the execution of arbitrary code with the context of the process. This bypasses security measures such as '--disallow-code-generation-from-strings', making it a severe risk for applications using vm2 versions up to 3.11.7.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.8
This is the first release that contains the fix.
npm install vm2@3.11.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'console: inherit' option when creating a NodeVM instance. This can help mitigate the risk of sandbox escape until the package is updated. Here is an example of creating a NodeVM without inheriting the console:
const { NodeVM } = require('vm2');
const vm = new NodeVM({ console: 'off' });
Conclusion
The vm2 package has a critical vulnerability that allows sandbox escape, posing significant risks to applications using affected versions. It is crucial to update to version 3.11.8 or later to mitigate this risk. Additionally, using Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for vm2 →
FAQ
The vulnerability allows attackers to escape the vm2 sandbox, potentially executing arbitrary code on the host system, leading to severe security risks.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
All versions of vm2 up to and including 3.11.7 are affected by this vulnerability. Version 3.11.8 and later contain the necessary fix.
If an immediate update is not possible, consider implementing the workaround by disabling the console inheritance when creating a NodeVM instance.
The CVSS score of this vulnerability is 10.0, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
