Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck

CVE-2026-92950vm2 before 3.11.7 Sandbox Escape via CLI require

High 8.6

In plain English

A high-severity security flaw in vm2 from patriksimek. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.2%top 90.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	vm2	3.11.7	GHSA-jxxv-8r27-vm4p

Affected products (as reported)

Vendor	Product	Versions
patriksimek	vm2	0 – before 3.11.7

Weakness: CWE-453 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-jxxv-8r27-vm4p) vendor-advisory
VulnCheck Advisory: vm2 before 3.11.7 Sandbox Escape via CLI require third-party-advisory