---
title: "vm2: 22 Critical Sandbox Escapes, Fixed in 3.12.2"
url: https://erroneo.us/security/briefs/vm2-sandbox-escape-wave-3-12-2/
description: "35 vm2 advisories (Aug 17-Oct 7, 2026), 22 critical, show sandbox escapes to host RCE, some from a default new VM(). Upgrade to 3.12.2; isolate untrusted code."
type: security-brief
section: "Security Digest"
date_published: 2026-08-17
date_modified: 2026-10-07
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-47683", "CVE-2026-47686", "CVE-2026-47698", "CVE-2026-92945", "CVE-2026-92941", "CVE-2026-92944", "CVE-2026-92939", "CVE-2026-92938", "CVE-2026-92937", "CVE-2026-92935", "CVE-2026-92949", "CVE-2026-92957", "CVE-2026-92958", "CVE-2026-92951", "CVE-2026-92940", "CVE-2026-92950", "CVE-2026-92948", "CVE-2026-92952", "CVE-2026-92956", "CVE-2026-92947", "CVE-2026-92946", "CVE-2026-92942", "CVE-2026-92936", "CVE-2026-92933", "CVE-2026-92934", "CVE-2026-92953", "CVE-2026-92954", "CVE-2026-92955", "CVE-2026-92959", "CVE-2026-100723", "CVE-2026-100722", "CVE-2026-100721", "CVE-2026-93605"]
severity: "critical"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# vm2: 22 Critical Sandbox Escapes, Fixed in 3.12.2

**Verdict: Check exposure.** If anything outside your trust boundary can get code into vm2, upgrade to 3.12.2 today and plan to move that code out of process; if vm2 only runs your own code, upgrade on a normal cycle.

- **Who must act:** Apps that use vm2 to run user-, tenant- or model-supplied JavaScript (plugin systems, rule and template engines, workflow and low-code tools, online code runners, AI agent code tools), directly or through a dependency.
- **Who can relax:** Projects where vm2 is a transitive dependency that never evaluates attacker-influenced code; patch it, but no escape is reachable without control of the sandboxed script.
- **Affected:** vm2 3.12.1 and earlier (each advisory lists its own range; the newest fixes need 3.12.2)
- **Fixed:** vm2 3.12.2 (released Sep 8, 2026; latest on npm as of Oct 21, 2026)
- **CVEs:** CVE-2026-47683, CVE-2026-47686, CVE-2026-47698, CVE-2026-92945, CVE-2026-92941, CVE-2026-92944, CVE-2026-92939, CVE-2026-92938, CVE-2026-92937, CVE-2026-92935, CVE-2026-92949, CVE-2026-92957, CVE-2026-92958, CVE-2026-92951, CVE-2026-92940, CVE-2026-92950, CVE-2026-92948, CVE-2026-92952, CVE-2026-92956, CVE-2026-92947, CVE-2026-92946, CVE-2026-92942, CVE-2026-92936, CVE-2026-92933, CVE-2026-92934, CVE-2026-92953, CVE-2026-92954, CVE-2026-92955, CVE-2026-92959, CVE-2026-100723, CVE-2026-100722, CVE-2026-100721, CVE-2026-93605
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. Find every copy: run npm ls vm2 --all (or pnpm why vm2 / yarn why vm2) in each service and image.
2. Upgrade to vm2 3.12.2, forcing transitive copies with an npm overrides (or pnpm/yarn resolutions) entry, then rebuild and redeploy.
3. If the sandbox runs code from outside your trust boundary, move it to stronger isolation: a separate low-privilege process or Worker, a container, gVisor or Firecracker, as the vm2 README recommends.
4. Until then, avoid NodeVM builtin: ['*'], nesting: true and require.external without require.root, and do not expose host functions that throw or return host objects.
5. If untrusted code ran under an older vm2, rotate the secrets that Node process could read: environment variables, cloud and database credentials, tokens.

### How to check if you are affected

- Check versions in lockfiles: grep -n '"node_modules/vm2"' -A2 package-lock.json, or npm ls vm2 --all.
- Review stored or logged sandbox submissions for escape primitives named in the advisories: child_process, Error.cause tricks, __lookupGetter__, Symbol.species, WebAssembly.compileStreaming, crypto setEngine, node:sqlite, node:test.
- On hosts that ran untrusted code, look for child processes of node (sh, curl, id), unexpected outbound connections and new files written by the app user.

## What happened

Between August 17 and October 7, 2026, the GitHub Advisory Database published 35 reviewed advisories for [vm2](https://github.com/patriksimek/vm2), the npm library that runs JavaScript in a sandbox inside your own Node.js process. 22 are rated critical, most with CVSS 3.1 scores from 9.8 to 10.0, and most of those are escapes from the sandbox to code execution on the host. The fixes shipped first: per the [npm registry](https://registry.npmjs.org/vm2), vm2 3.11.6 came out on August 14, followed by 3.11.7, 3.11.8, 3.12.0, 3.12.1 and 3.12.2 between August 24 and September 8. For example, the maintainer published [GHSA-pq68-rvw4-xp4r](https://github.com/patriksimek/vm2/security/advisories/GHSA-pq68-rvw4-xp4r) with 3.12.1 on September 3. VulnCheck assigned it [CVE-2026-93605](https://www.cve.org/CVERecord?id=CVE-2026-93605) on September 18, and it reached the global database on October 7. The same database already held 19 critical vm2 advisories from January and May 2026.

The bugs, listed on the project's [advisory page](https://github.com/patriksimek/vm2/security/advisories), fall into a few groups:

- **Bypasses of earlier fixes.** [GHSA-m283-3h24-438v](https://github.com/patriksimek/vm2/security/advisories/GHSA-m283-3h24-438v) (CVE-2026-47686) showed that host errors carrying `Error.cause` leaked objects such as `process`. GHSA-647f-g98j-qq25 then bypassed that fix through call/apply indirection. GHSA-cfcw-xp6x-25gj bypassed an older prototype-mutator fix by adding one more indirect call.
- **Node.js 26 engine changes.** [GHSA-27g9-p43v-cw3v](https://github.com/advisories/GHSA-27g9-p43v-cw3v) and [GHSA-wjwh-qqvp-g4p4](https://github.com/advisories/GHSA-wjwh-qqvp-g4p4) escape through Promise species tricks on Node.js 26. The latter says it is reachable from a default `new VM()`, with "No `NodeVM`, `require` permission, host object injection, or intentionally unsafe configuration" required.
- **NodeVM policy gaps.** The builtin denylist left out `child_process` (GHSA-pq68, CVSS 10.0). Other advisories cover `node:`-prefixed deny entries, `node:test` `execArgv`, an array-shaped `require` that defeats the nesting guard, native code loaded through `crypto` `setEngine` and `node:sqlite`, and host TLS credentials and trust stores exposed through `https`.
- **Host memory.** GHSA-fcqc-726x-5wfc lets sandboxed code read and write host memory through Node's shared `Buffer` pool.

Most advisories include a working proof of concept. No in-the-wild exploitation has been reported as of October 21, 2026, and none of these CVEs is in CISA KEV.

## Who is affected

Every vm2 release up to 3.12.1 is affected by at least one advisory, and 3.12.2 is the first release with all of them fixed. The risk lands on applications that hand vm2 code they did not write: plugin and extension systems, rule and template engines, workflow and low-code tools, online code runners, and AI agent tools that execute model-generated JavaScript. vm2 had 422,427 [downloads](https://api.npmjs.org/downloads/point/2026-10-13:2026-10-19/vm2) in the week of October 13–19, many of them as a dependency of other packages. Some bugs need a particular NodeVM setup (wildcard builtins, `nesting`, `require.external`); others work against a plain `new VM()`.

## Do you really need to act?

It depends on who writes the code that vm2 runs. If vm2 is buried in your dependency tree and only evaluates your own trusted code, none of these escapes is reachable. Upgrade normally. If users, tenants, uploaded templates or prompt-injected model output can get code into the sandbox, treat this as urgent. The proofs of concept are short, and a successful escape gets everything the Node process can reach: environment variables, cloud and database credentials, the file system and the network.

Patching is not a long-term answer. The README says that "researchers and security professionals continuously discover new ways to escape the vm2 sandbox". For "completely untrusted sources" it recommends stronger isolation: separate processes or Worker threads with limited permissions, containers or microVMs (Docker, gVisor, Firecracker), managed execution services, or isolated-vm. The README notes that isolated-vm is "in maintenance mode". It also warns: "Do not enable `nesting: true` for untrusted code," and says not to use vm2 on Bun for untrusted code.

## What to do now

1. Inventory: `npm ls vm2 --all`, `pnpm why vm2` or `yarn why vm2` in every service, and inside built container images.
2. Upgrade: `npm install vm2@3.12.2`. For transitive copies, add `"overrides": {"vm2": "3.12.2"}` to `package.json`, run `npm install`, and confirm with `npm ls vm2 --all`. Rebuild and redeploy images.
3. Run untrusted code in a separate low-privilege process, container or microVM with no secrets in its environment.
4. Harden in the meantime: drop `builtin: ['*']`, never use `nesting: true`, set an explicit `require.root` with `require.external`, and avoid exposing host functions whose errors or promises carry host objects.
5. If untrusted code ran under an older version, rotate every secret that the Node process could read.

## How to tell if you were hit

No exploitation has been reported, so there are no campaign indicators. The useful evidence is the sandboxed code itself. Search stored or logged submissions for the advisories' primitives: `child_process`, `Error.cause` games, `__lookupGetter__`, `Symbol.species`, `WebAssembly.compileStreaming`, `setEngine`, `node:sqlite` and `node:test`. On hosts that ran untrusted code, look for shells or tools (`sh`, `curl`, `id`) spawned by `node`, unexpected outbound connections, and files written by the app's user.

## Timeline

- Aug 14, 2026 — vm2 3.11.6 is released.
- Aug 17, 2026 — Five advisories are published, three of them critical (including CVE-2026-47686 and CVE-2026-47698), all fixed in 3.11.6.
- Aug 24, 2026 — Fixes keep shipping: 3.11.7 (Aug 24), 3.11.8 (Aug 27), 3.12.0 (Sep 1), 3.12.1 (Sep 3) and 3.12.2 (Sep 8).
- Sep 18, 2026 — VulnCheck publishes CVE-2026-93605 for the `child_process` denylist gap.
- Oct 1, 2026 — 15 more advisories are published, 10 of them critical. Fourteen follow on Oct 5, 8 of them critical.
- Oct 7, 2026 — GHSA-pq68-rvw4-xp4r (CVSS 10.0) enters the global advisory database.

## Sources

1. [vm2 — Security advisories (patriksimek/vm2)](https://github.com/patriksimek/vm2/security/advisories)
2. [vm2 — GHSA-pq68-rvw4-xp4r: NodeVM denylist omits child_process (CVE-2026-93605)](https://github.com/patriksimek/vm2/security/advisories/GHSA-pq68-rvw4-xp4r)
3. [vm2 — GHSA-m283-3h24-438v: Missing Error.cause sanitization (CVE-2026-47686)](https://github.com/patriksimek/vm2/security/advisories/GHSA-m283-3h24-438v)
4. [GitHub Advisory Database — GHSA-wjwh-qqvp-g4p4: escape via WebAssembly.compileStreaming (CVE-2026-92956)](https://github.com/advisories/GHSA-wjwh-qqvp-g4p4)
5. [GitHub Advisory Database — GHSA-27g9-p43v-cw3v: escape on Node.js 26 (CVE-2026-92944)](https://github.com/advisories/GHSA-27g9-p43v-cw3v)
6. [GitHub Advisory Database API — npm vm2 advisories](https://api.github.com/advisories?ecosystem=npm&affects=vm2&per_page=100)
7. [CVE record — CVE-2026-93605](https://www.cve.org/CVERecord?id=CVE-2026-93605)
8. [CVE record — CVE-2026-47686](https://www.cve.org/CVERecord?id=CVE-2026-47686)
9. [vm2 — README (security notes and alternatives)](https://github.com/patriksimek/vm2)
10. [npm registry — vm2 package metadata and release times](https://registry.npmjs.org/vm2)
11. [npm — vm2 downloads, Oct 13-19, 2026](https://api.npmjs.org/downloads/point/2026-10-13:2026-10-19/vm2)

---
Source page: https://erroneo.us/security/briefs/vm2-sandbox-escape-wave-3-12-2/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt