CVE-2026-92935

Description

vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' && requireOpts !== null`, so an array-shaped `require` value (for example `require: []`) satisfies the guard that is meant to reject nesting without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array into undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy `nesting` and an array-shaped `require` (e.g. `new NodeVM({nesting: true, require: []})`) can require the host `vm2` module, create an inner NodeVM with an attacker-chosen builtin allowlist (such as `child_process`), and execute arbitrary commands with the privileges of the host Node.js process, escaping the sandbox. Outer builtin restrictions do not constrain the attacker-created inner NodeVM. This issue is fixed in vm2 3.11.7.

CVSS 3.1 breakdown

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

• https://github.com/patriksimek/vm2/commit/54b54b74a382577f0bcd0538c5bf99acdcd7f53b
• https://github.com/patriksimek/vm2/security/advisories/GHSA-8hr7-r645-pc6w
• https://www.vulncheck.com/advisories/vm2-nodevm-remote-code-execution-via-array-shaped-require

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked