CVE-2026-93605

vm2 NodeVM versions before 3.12.1 fail to block the child_process module in the DANGEROUS_BUILTINS denylist, even though other host-spawning modules are blocked, allowing code running inside the sandbox to break out. The flaw is triggered when an attacker can execute JavaScript within a NodeVM instance that is configured with builtin:['*'] or that explicitly allows child_process; the attacker then requires child_process directly. Successful exploitation yields arbitrary command execution on the host system with the privileges of the Node.js process, with network-based attack vectors requiring no privileges or user interaction (CVSS 4.0 score 10.0, critical). Any application or service running untrusted code in vm2 NodeVM with a permissive builtin configuration before version 3.12.1 is affected. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; the issue was assigned by VulnCheck's CNA.

What to do: Upgrade vm2 to 3.12.1 or later. If upgrading is not immediately possible, do not use builtin:['*'] and remove child_process (and other host-spawning builtins) from the allowlist for any NodeVM running untrusted code. Audit whether your NodeVM instances execute attacker-controlled JavaScript with permissive builtin settings, and consider migrating to stronger isolation (e.g., separate processes or containers) given vm2's history of sandbox escapes.