CVE-2026-92957 patriksimek CVE debrief

Who should care

Developers and administrators using vm2 in sandboxed environments should assess exposure and update to version 3.11.7 or later to mitigate potential command-execution capability. This includes reviewing and verifying inventory of systems and applications using vm2, and assessing potential impacts on sandboxed code and host systems.

Why it matters

CVE-2026-92957 allows sandboxed code in vm2 to access the host's child_process module, potentially leading to command-execution capability. Developers and administrators should assess exposure, update to version 3.11.7 or later, and verify inventory of systems and applications using vm2.

• Potential command-execution capability for untrusted sandbox code
• Ability of sandboxed code to access host child_process module
• Bypass of intended deny policy for require('child_process') or require('node:child_process')

Technical summary

The vm2 library through version 3.11.6 does not properly normalize node:-prefixed builtin specifiers when evaluating user-supplied negative entries in a NodeVM wildcard require policy. This allows sandboxed code to access the host's child_process module, potentially leading to command-execution capability. The vulnerability is fixed in vm2 version 3.11.7. Affected deployments should be reviewed for exposure and updated to mitigate potential command-execution capability. The issue arises from exact string comparison against canonical builtin names, bypassing intended deny policies for require('child_process') or require('node:child_process').

Defensive priority

High

Recommended defensive actions

• Review and update vm2 to version 3.11.7 or later
• Assess exposure of sandboxed code to potential command-execution capability
• Verify inventory of systems and applications using vm2
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail page provide information on vm2 vulnerability through version 3.11.6. The vulnerability allows sandboxed code to access the host's child_process module, potentially leading to command-execution capability. A fix is available in vm2 version 3.11.7. Evidence is limited to CVE Program and NVD records; further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.