Advisory · CVE-2026-93605
vm2 NodeVM flaw lets sandboxed code spawn host processes
NodeVM's denylist omits child_process, so sandboxed code can execute arbitrary host commands when builtins are broadly allowed.
- Vendor
- vm2
- Product
- vm2
- Identifier / CWE
- CVE-2026-93605
CWE-693 - Action timing
- Immediate
Explain it like I’m five
vm2's NodeVM keeps a list of dangerous tools the playpen is not allowed to touch, but it forgot to put the power drill on the list. Code inside the playpen can pick it up and drill straight out.
- 01Broad builtins
NodeVM is configured with builtin:['*'] or explicit child_process allowance.
- 02Missing denylist entry
The DANGEROUS_BUILTINS denylist blocks other host-spawning modules but omits child_process.
- 03Module required
Sandboxed code requires child_process from inside the sandbox.
- 04Host commands
The attacker executes arbitrary commands on the host system.
What happened
A second sandbox-escape flaw in vm2 (CVE-2026-93605, CVSS 10.0) affects NodeVM releases before 3.12.1. The DANGEROUS_BUILTINS denylist omits child_process even though it blocks other host-spawning modules. When NodeVM is configured with builtin:['*'] or explicit child_process allowance, sandboxed code can require child_process and execute arbitrary commands on the host.
This is a distinct flaw from the bridge issue (CVE-2026-93603) disclosed the same day, and both are fixed in vm2 3.12.1.
What to do
- Upgrade vm2 to 3.12.1 or later.
- Audit NodeVM configurations for broad builtin allowances and narrow them to the minimum required set.
- Never allow child_process or other process-spawning modules in sandboxes that run untrusted code.
- Review logs for child_process use from sandboxed workloads and investigate any unexpected host command execution.
Management note
Two 10.0 sandbox escapes in the same release, disclosed the same day, is a signal to treat vm2 as a control that just failed twice. Patch immediately and reassess whether sandboxing untrusted code in-process is the right architecture.