vm2 npm Package Vulnerability: Critical Sandbox Escape Risk
- Severity
- CRITICAL
- CVSS
- 10
- Affected component
- vm2 (npm)
- Affected versions
- < 3.11.3 or < 3.11.2 or < 3.11.0 or < 3.9.10 or < 3.11.0 or < 3.11.0 or < 3.11.4 or < 3.9.6 or < 3.11.4 or < 3.9.15 or < 3.11.1 or >= 3.10.5, < 3.11.0 or >= 3.10.5, <= 3.10.5 or < 3.10.2 or < 3.11.4 or < 3.11.2 or < 3.11.2 or < 3.11.4 or < 3.10.0 or < 3.11.6 or < 3.9.17 or >= 3.10.5, < 3.11.0 or >= 3.10.5, <= 3.10.5 or < 3.10.5 or <= 3.9.19 or < 3.11.6 or < 3.11.0 or < 3.11.0 or < 3.11.6 or < 3.11.4 or < 3.11.4 or < 3.11.6 or < 3.11.0 or < 3.9.11 or < 3.9.18 or < 3.11.4 or < 3.11.0 or < 3.10.5 or < 3.11.4 or < 3.9.4 or < 3.11.4 or < 3.11.0 or < 3.11.0 or < 3.11.4 or < 3.11.6 or >= 3.9.6, < 3.11.0 or < 3.6.11 or < 3.9.18 or < 3.11.0 or < 3.9.16
- Patched version
- 3.12.1
An early warning has been issued for a critical vulnerability in the vm2 npm package. This vulnerability, tracked as CVE-2026-93603, could allow sandbox escape and remote code execution if non-strict host functions are exposed to the sandbox.
What happened
The vm2 npm package before version 3.12.1 reportedly does not correctly handle a nullish `this` receiver in the apply trap. This oversight could allow an attacker to escape the sandbox and execute remote code. Exploitation of this vulnerability requires exposing non-strict host functions to the sandbox.
This vulnerability has been assigned a CVSS score of 10.0, indicating a critical severity level. The issue was first flagged on 2026-09-18T14:19:12.003000+00:00. The vulnerability has not been reported as exploited in the wild, and there is no evidence of a supply-chain attack at this time.
What to do about it
- Upgrade to vm2@3.12.1 or later to mitigate the risk of sandbox escape and remote code execution.
- Review your application to ensure that non-strict host functions are not exposed to the sandbox.
- Monitor the primary sources for updates on this vulnerability.
- Consider implementing additional security measures to protect against potential sandbox escape attempts.
How 0Day would have caught this
vm2 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using vm2 npm package versions less than 3.12.1. Check your package.json or your dependency management tool for the exact version you are using.
What should I do right now?
Immediately upgrade to vm2@3.12.1 or later. Additionally, review your application to ensure that non-strict host functions are not exposed to the sandbox.
Is this vulnerability being exploited in the wild?
There is no reported evidence of this vulnerability being exploited in the wild at this time.
Where can I find more information about this vulnerability?
Consult the primary sources listed in the threat data, particularly the NVD entry for CVE-2026-93603.