Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck

CVE-2026-92957vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix

Critical 9.9

In plain English

A critical-severity privilege mismanagement in vm2 from patriksimek. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.5%top 54.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, negative wildcard entries are matched by exact string comparison against the canonical builtin names, so a policy such as `new NodeVM({ require: { builtin: ['*', '-node:child_process'] } })` fails to deny the canonical `child_process` module. Sandboxed code can therefore obtain the host `child_process` builtin via `require('child_process')` or `require('node:child_process')`, gaining references to process-spawning APIs such as execSync and spawn, which is equivalent to host command-execution capability for untrusted sandbox code. Fixed in vm2 3.11.7.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	vm2	3.11.7	GHSA-8686-vhfx-7r3j

Affected products (as reported)

Vendor	Product	Versions
patriksimek	vm2	0 – before 3.11.7

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-8686-vhfx-7r3j) vendor-advisory
VulnCheck Advisory: vm2 before 3.11.7 Authentication Bypass via node: Prefix third-party-advisory