Critical Vulnerability in vm2 npm Package: Upgrade to 3.11.7
- Severity
- CRITICAL
- CVSS
- 9
- Affected component
- vm2 (npm)
- Affected versions
- < 3.11.3 or < 3.11.2 or < 3.11.0 or < 3.9.10 or < 3.11.0 or < 3.11.0 or < 3.11.4 or < 3.9.6 or < 3.11.4 or < 3.9.15 or < 3.11.1 or >= 3.10.5, < 3.11.0 or >= 3.10.5, <= 3.10.5 or < 3.10.2 or < 3.11.4 or < 3.11.2 or < 3.11.2 or < 3.11.4 or < 3.10.0 or < 3.11.6 or < 3.9.17 or >= 3.10.5, < 3.11.0 or >= 3.10.5, <= 3.10.5 or < 3.10.5 or <= 3.9.19 or < 3.11.6 or < 3.11.0 or < 3.11.0 or < 3.11.6 or < 3.11.4 or < 3.11.4 or < 3.11.6 or < 3.11.0 or < 3.9.11 or < 3.9.18 or < 3.11.4 or < 3.11.0 or < 3.10.5 or < 3.11.4 or < 3.9.4 or < 3.11.4 or < 3.11.0 or < 3.11.0 or < 3.11.4 or < 3.11.6 or >= 3.9.6, < 3.11.0 or < 3.6.11 or < 3.9.18 or < 3.11.0 or < 3.9.16
- Patched version
- 3.11.7
The vm2 npm package has a critical vulnerability in versions >= 3.11.4 and <= 3.11.6 that allows an attacker to escape the sandbox and execute arbitrary commands with host privileges.
What happened
A critical vulnerability has been identified in the vm2 npm package. Versions >= 3.11.4 and <= 3.11.6 are affected. This vulnerability allows an attacker to escape the sandbox and execute arbitrary commands with host privileges. The vulnerability was first flagged on 2026-09-17T14:17:57.810000+00:00 and confirmed on 2026-09-17T15:12:11.606700+00:00.
The vulnerability has been tracked under multiple CVEs including CVE-2026-92934, CVE-2026-92935, CVE-2026-92937, CVE-2026-92938, CVE-2026-92939, CVE-2026-92940, CVE-2026-92941, CVE-2026-92944, CVE-2026-92946, CVE-2026-92947, CVE-2026-92948, and CVE-2026-92951. All have a CVSS score of 9.0 or higher, indicating a critical severity level.
What to do about it
- Upgrade to vm2 version 3.11.7 or later to mitigate the risk.
- Review your project dependencies to identify any usage of vm2 within the affected version range.
- If you are unable to upgrade immediately, consider alternative sandboxing solutions to reduce risk.
- Monitor the primary sources for any updates or additional information related to this vulnerability.
How 0Day would have caught this
vm2 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using vm2 npm package versions >= 3.11.4 and <= 3.11.6.
What should I do right now?
Upgrade to vm2 version 3.11.7 or later to mitigate the risk.
Has this been exploited in the wild?
No, this vulnerability has not been exploited in the wild according to the primary sources.