vm2: 22 Critical Sandbox Escapes, Fixed in 3.12.2

What to do

1. Find every copy: run npm ls vm2 --all (or pnpm why vm2 / yarn why vm2) in each service and image.
2. Upgrade to vm2 3.12.2, forcing transitive copies with an npm overrides (or pnpm/yarn resolutions) entry, then rebuild and redeploy.
3. If the sandbox runs code from outside your trust boundary, move it to stronger isolation: a separate low-privilege process or Worker, a container, gVisor or Firecracker, as the vm2 README recommends.
4. Until then, avoid NodeVM builtin: ['*'], nesting: true and require.external without require.root, and do not expose host functions that throw or return host objects.
5. If untrusted code ran under an older vm2, rotate the secrets that Node process could read: environment variables, cloud and database credentials, tokens.

How to check if you are affected or compromised

• Check versions in lockfiles: grep -n '"node_modules/vm2"' -A2 package-lock.json, or npm ls vm2 --all.
• Review stored or logged sandbox submissions for escape primitives named in the advisories: child_process, Error.cause tricks, __lookupGetter__, Symbol.species, WebAssembly.compileStreaming, crypto setEngine, node:sqlite, node:test.
• On hosts that ran untrusted code, look for child processes of node (sh, curl, id), unexpected outbound connections and new files written by the app user.

What happened#

Between August 17 and October 7, 2026, the GitHub Advisory Database published 35 reviewed advisories for vm2, the npm library that runs JavaScript in a sandbox inside your own Node.js process. 22 are rated critical, most with CVSS 3.1 scores from 9.8 to 10.0, and most of those are escapes from the sandbox to code execution on the host. The fixes shipped first: per the npm registry, vm2 3.11.6 came out on August 14, followed by 3.11.7, 3.11.8, 3.12.0, 3.12.1 and 3.12.2 between August 24 and September 8. For example, the maintainer published GHSA-pq68-rvw4-xp4r with 3.12.1 on September 3. VulnCheck assigned it CVE-2026-93605 on September 18, and it reached the global database on October 7. The same database already held 19 critical vm2 advisories from January and May 2026.

The bugs, listed on the project's advisory page, fall into a few groups:

• Bypasses of earlier fixes. GHSA-m283-3h24-438v (CVE-2026-47686) showed that host errors carrying Error.cause leaked objects such as process. GHSA-647f-g98j-qq25 then bypassed that fix through call/apply indirection. GHSA-cfcw-xp6x-25gj bypassed an older prototype-mutator fix by adding one more indirect call.
• Node.js 26 engine changes. GHSA-27g9-p43v-cw3v and GHSA-wjwh-qqvp-g4p4 escape through Promise species tricks on Node.js 26. The latter says it is reachable from a default new VM(), with "No NodeVM, require permission, host object injection, or intentionally unsafe configuration" required.
• NodeVM policy gaps. The builtin denylist left out child_process (GHSA-pq68, CVSS 10.0). Other advisories cover node:-prefixed deny entries, node:test execArgv, an array-shaped require that defeats the nesting guard, native code loaded through crypto setEngine and node:sqlite, and host TLS credentials and trust stores exposed through https.
• Host memory. GHSA-fcqc-726x-5wfc lets sandboxed code read and write host memory through Node's shared Buffer pool.

Most advisories include a working proof of concept. No in-the-wild exploitation has been reported as of October 21, 2026, and none of these CVEs is in CISA KEV.

Who is affected#

Every vm2 release up to 3.12.1 is affected by at least one advisory, and 3.12.2 is the first release with all of them fixed. The risk lands on applications that hand vm2 code they did not write: plugin and extension systems, rule and template engines, workflow and low-code tools, online code runners, and AI agent tools that execute model-generated JavaScript. vm2 had 422,427 downloads in the week of October 13–19, many of them as a dependency of other packages. Some bugs need a particular NodeVM setup (wildcard builtins, nesting, require.external); others work against a plain new VM().

Do you really need to act?#

It depends on who writes the code that vm2 runs. If vm2 is buried in your dependency tree and only evaluates your own trusted code, none of these escapes is reachable. Upgrade normally. If users, tenants, uploaded templates or prompt-injected model output can get code into the sandbox, treat this as urgent. The proofs of concept are short, and a successful escape gets everything the Node process can reach: environment variables, cloud and database credentials, the file system and the network.

Patching is not a long-term answer. The README says that "researchers and security professionals continuously discover new ways to escape the vm2 sandbox". For "completely untrusted sources" it recommends stronger isolation: separate processes or Worker threads with limited permissions, containers or microVMs (Docker, gVisor, Firecracker), managed execution services, or isolated-vm. The README notes that isolated-vm is "in maintenance mode". It also warns: "Do not enable nesting: true for untrusted code," and says not to use vm2 on Bun for untrusted code.

What to do now#

1. Inventory: npm ls vm2 --all, pnpm why vm2 or yarn why vm2 in every service, and inside built container images.
2. Upgrade: npm install vm2@3.12.2. For transitive copies, add "overrides": {"vm2": "3.12.2"} to package.json, run npm install, and confirm with npm ls vm2 --all. Rebuild and redeploy images.
3. Run untrusted code in a separate low-privilege process, container or microVM with no secrets in its environment.
4. Harden in the meantime: drop builtin: ['*'], never use nesting: true, set an explicit require.root with require.external, and avoid exposing host functions whose errors or promises carry host objects.
5. If untrusted code ran under an older version, rotate every secret that the Node process could read.

How to tell if you were hit#

No exploitation has been reported, so there are no campaign indicators. The useful evidence is the sandboxed code itself. Search stored or logged submissions for the advisories' primitives: child_process, Error.cause games, __lookupGetter__, Symbol.species, WebAssembly.compileStreaming, setEngine, node:sqlite and node:test. On hosts that ran untrusted code, look for shells or tools (sh, curl, id) spawned by node, unexpected outbound connections, and files written by the app's user.

Timeline#

• Aug 14, 2026 — vm2 3.11.6 is released.
• Aug 17, 2026 — Five advisories are published, three of them critical (including CVE-2026-47686 and CVE-2026-47698), all fixed in 3.11.6.
• Aug 24, 2026 — Fixes keep shipping: 3.11.7 (Aug 24), 3.11.8 (Aug 27), 3.12.0 (Sep 1), 3.12.1 (Sep 3) and 3.12.2 (Sep 8).
• Sep 18, 2026 — VulnCheck publishes CVE-2026-93605 for the child_process denylist gap.
• Oct 1, 2026 — 15 more advisories are published, 10 of them critical. Fourteen follow on Oct 5, 8 of them critical.
• Oct 7, 2026 — GHSA-pq68-rvw4-xp4r (CVSS 10.0) enters the global advisory database.

Vulnerability records

• CVE-2026-47683 · vm2 is an open source vm/sandbox for Node.js.
• CVE-2026-47686 · vm2 is an open source vm/sandbox for Node.js.
• CVE-2026-47698 · vm2 is an open source vm/sandbox for Node.js.
• CVE-2026-92945 · vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored…
• CVE-2026-92941 · vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and…
• CVE-2026-92944 · vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper protections…
• CVE-2026-92939 · vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed.
• CVE-2026-92938 · vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or…
• CVE-2026-92937 · vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process.
• CVE-2026-92935 · vm2 is a sandbox for running untrusted Node.js code.
• CVE-2026-92949 · vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass…
• CVE-2026-92957 · vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require…
• CVE-2026-92958 · vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM.
• CVE-2026-92951 · vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of…
• CVE-2026-92940 · vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow…
• CVE-2026-92950 · vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process.
• CVE-2026-92948 · vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder…
• CVE-2026-92952 · vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary.
• CVE-2026-92956 · vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26.
• CVE-2026-92947 · vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related…
• CVE-2026-92946 · vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules.
• CVE-2026-92942 · vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call.
• CVE-2026-92936 · vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting.
• CVE-2026-92933 · vm2 is a sandbox for running untrusted Node.js code.
• CVE-2026-92934 · vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are…
• CVE-2026-92953 · vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation.
• CVE-2026-92954 · vm2 is a sandbox library for running untrusted JavaScript in Node.js.
• CVE-2026-92955 · vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout…
• CVE-2026-92959 · vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM.
• CVE-2026-100723 · vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from…
• CVE-2026-100722 · vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap.
• CVE-2026-100721 · vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver.
• CVE-2026-93605 · vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. vm2 — Security advisories (patriksimek/vm2) github.com
2. vm2 — GHSA-pq68-rvw4-xp4r: NodeVM denylist omits child_process (CVE-2026-93605) github.com
3. vm2 — GHSA-m283-3h24-438v: Missing Error.cause sanitization (CVE-2026-47686) github.com
4. GitHub Advisory Database — GHSA-wjwh-qqvp-g4p4: escape via WebAssembly.compileStreaming (CVE-2026-92956) github.com
5. GitHub Advisory Database — GHSA-27g9-p43v-cw3v: escape on Node.js 26 (CVE-2026-92944) github.com
6. GitHub Advisory Database API — npm vm2 advisories api.github.com
7. CVE record — CVE-2026-93605 cve.org
8. CVE record — CVE-2026-47686 cve.org
9. vm2 — README (security notes and alternatives) github.com
10. npm registry — vm2 package metadata and release times registry.npmjs.org
11. npm — vm2 downloads, Oct 13-19, 2026 api.npmjs.org