vm2 npm Package Vulnerability: Critical Sandbox Escape Reported
- Severity
- CRITICAL
- CVSS
- 10
- Affected component
- vm2 (npm)
- Affected versions
- < 3.11.3 or < 3.11.2 or < 3.11.0 or < 3.9.10 or < 3.11.0 or < 3.11.0 or < 3.11.4 or < 3.9.6 or < 3.11.4 or < 3.9.15 or < 3.11.1 or >= 3.10.5, < 3.11.0 or >= 3.10.5, <= 3.10.5 or < 3.10.2 or < 3.11.4 or < 3.11.2 or < 3.11.2 or < 3.11.4 or < 3.10.0 or < 3.11.6 or < 3.9.17 or >= 3.10.5, < 3.11.0 or >= 3.10.5, <= 3.10.5 or < 3.10.5 or <= 3.9.19 or < 3.11.6 or < 3.11.0 or < 3.11.0 or < 3.11.6 or < 3.11.4 or < 3.11.4 or < 3.11.6 or < 3.11.0 or < 3.9.11 or < 3.9.18 or < 3.11.4 or < 3.11.0 or < 3.10.5 or < 3.11.4 or < 3.9.4 or < 3.11.4 or < 3.11.0 or < 3.11.0 or < 3.11.4 or < 3.11.6 or >= 3.9.6, < 3.11.0 or < 3.6.11 or < 3.9.18 or < 3.11.0 or < 3.9.16
- Patched version
- 3.12.1
An early warning has been issued regarding a critical vulnerability in the vm2 npm package. Versions before 3.12.1 are reportedly affected by a sandbox escape issue that could allow arbitrary command execution on the host system.
What happened
The vm2 npm package, used for running untrusted code in a sandboxed environment, contains a vulnerability tracked as CVE-2026-93605. This vulnerability, with a CVSS score of 10, allows attackers to escape the sandbox and execute arbitrary commands on the host system. The issue arises from the DANGEROUS_BUILTINS denylist omitting child_process, which can be exploited when NodeVM is configured with builtin:['*'] or explicit child_process allowance.
The vulnerability affects multiple versions of vm2, as detailed in the affected components section. It is crucial for users to assess their exposure by checking their vm2 package versions against the provided list of affected versions.
What to do about it
- Upgrade to vm2 version 3.12.1 or later to mitigate the sandbox escape vulnerability.
- Review your project dependencies to identify any usage of vm2 and ensure it is updated to a secure version.
- Monitor the primary sources for any updates or additional information regarding this vulnerability.
How 0Day would have caught this
vm2 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using vm2 npm package versions before 3.12.1. Check your package versions against the affected components list provided.
What should I do right now?
Immediately upgrade to vm2 version 3.12.1 or later. Review your project dependencies and ensure all instances of vm2 are updated to a secure version.
Has this vulnerability been exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time.