Vulnerability · Published Sep 18, 2026 · Assigned by VulnCheck

CVE-2026-93604vm2 3.11.8 Sandbox Escape via crypto.setFips

High 7.2

In plain English

A high-severity improper access control in vm2 from patriksimek. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.3%top 71.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM (require.builtin: ['crypto']). The builtin sanitizer (sanitizeCryptoModule in lib/builtin.js) replaces crypto.setEngine but leaves crypto.setFips callable, and the readonly wrapper used to expose the host module does not localize side effects of forwarded host functions. Guest code can therefore call crypto.setFips() to change the FIPS mode of the entire host process; the modified mode is subsequently observed by trusted host code (crypto.getFips() changed from 0 to 1 in the reported test), crossing the NodeVM isolation boundary. Fixed in vm2 3.12.1.

Affected products (as reported)

Vendor	Product	Versions
patriksimek	vm2	0 – before 3.12.1

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

References

GitHub Security Advisory (GHSA-x3v6-43hc-82mc) vendor-advisory
VulnCheck Advisory: vm2 3.11.8 Sandbox Escape via crypto.setFips third-party-advisory