Six vm2 Sandbox Escape Vulnerabilities Allow Arbitrary Code Execution on the Host

What Happened

Security researchers identified six separate ways that code running inside vm2's NodeVM sandbox could break out of its intended isolation. The flaws share a common root cause: vm2's builtin-module allowlist/denylist logic and its object-freezing protections rely on string-matching and prefix logic that can be circumvented. Three of the six issues (CVE-2026-92938, CVE-2026-92957, CVE-2026-92948) permit sandboxed code to reach host-level Node.js builtins that should have been blocked, resulting in native code execution or command execution on the host process. A fourth (CVE-2026-92958) allows sandboxed code to reach the fs/promises filesystem API despite fs being explicitly denied, enabling file writes on the host. A fifth (CVE-2026-92949) allows sandboxed code to bypass vm.freeze()/vm.readonly() object protections by invoking host object setters directly. A sixth (CVE-2026-92945) allows sandboxed code to load non-allowlisted packages that share a name prefix with an allowlisted module.

Technical Cause

CVE-2026-92938: vm2 wraps the node:sqlite builtin with vm.readonly(), which blocks property assignment but leaves callable methods reachable. Because vm2's resolver strips only a single 'node:' prefix, a sandbox request for 'node:node:sqlite' resolves to the configured node:sqlite entry, letting sandboxed code create a DatabaseSync instance and call loadExtension() to load a native library into the host process, achieving arbitrary native code execution with host-process privileges. CVE-2026-92957: NodeVM's wildcard require policy supports negative (deny) entries, but these are matched by exact string comparison against canonical builtin names rather than being normalized for the 'node:' prefix. A policy like builtin: ['*', '-node:child_process'] therefore fails to deny the canonical 'child_process' name, so sandboxed code can still require('child_process') and obtain process-spawning APis such as execSync and spawn. CVE-2026-92948: On Node.js 24+, module.builtinModules exposes a scheme-only key 'node:test' that is not covered by vm2's family-based DANGEROUS_BUILTINS protection. Because the resolver strips only one 'node:' prefix, a request for 'node:node:test' resolves to the stored node:test entry. Calling node:test.run() forwards attacker-controlled execArgv values (such as --eval=<JavaScript>) to a separate host Node process, resulting in arbitrary JavaScript execution outside the sandbox. CVE-2026-92958: Negative builtin denylist entries (e.g. '-fs') are matched by exact module name only, so they do not cover subpaths such as fs/promises. Sandboxed code can therefore require('fs/promises') or require('node:fs/promises') and reach filesystem write/read operations despite fs being denied. CVE-2026-92949: vm2's object-freezing protections (vm.freeze(), vm.readonly()) do not properly restrict access to accessor properties. Sandboxed code can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to extract and directly invoke host object setters, mutating properties intended to be read-only. CVE-2026-92945: The isPathAllowedForModule allowlist check uses raw string prefix matching instead of boundary-anchored comparison, so a module name that shares a prefix with an allowlisted module can be reached via relative requires from an allowlisted package, even when transitive loading is disabled.

Why It Matters

vm2 is designed specifically to run untrusted JavaScript safely, so any sandbox escape undermines its core purpose. The three critical-rated flaws (CVSS 9.4) let untrusted plugin or script code obtain full native code execution or host command execution, equivalent to running arbitrary code with the privileges of the host Node.js process. The filesystem-access flaw (CVSS 8.4) allows unauthorized reads and writes outside the sandbox. Applications that embed vm2 to execute third-party plugins, user scripts, or other untrusted code are directly exposed to full host compromise if any of these builtins are permitted in their configuration.

Who Is Affected

Any application using vm2's NodeVM to sandbox untrusted JavaScript is potentially affected, depending on which builtin modules are permitted in the embedder's configuration. CVE-2026-92938 requires node:sqlite to be permitted (explicitly or via builtin: ['*']). CVE-2026-92957 and CVE-2026-92958 affect configurations using wildcard require policies with negative (deny) entries intended to block specific builtins. CVE-2026-92948 requires node:test to be explicitly permitted and affects Node.js 24 and newer. CVE-2026-92949 and CVE-2026-92945 affect vm.freeze()/vm.readonly() usage and external module allowlisting, respectively, regardless of specific builtin configuration.

Affected Versions

CVE-2026-92938 affects vm2 versions 3.11.3 through 3.11.6. CVE-2026-92957 and CVE-2026-92958 affect vm2 versions up to and including 3.11.6. CVE-2026-92948 and CVE-2026-92949 affect vm2 versions 3.9.6 through 3.11.6. CVE-2026-92945 affects vm2 versions up to and including 3.11.6. All six issues are fixed in vm2 3.11.7.

Fixes and Mitigation

All six vulnerabilities are fixed in vm2 3.11.7. No partial mitigations or workarounds beyond upgrading are described in the available facts.

Recommended Action

Upgrade vm2 to version 3.11.7 as soon as possible. Until upgraded, review your NodeVM configuration: avoid permitting node:sqlite or node:test builtins, avoid relying on negative (deny) entries in wildcard require policies to block child_process or fs (since these can be bypassed), and treat vm.freeze()/vm.readonly() as insufficient on their own to prevent property mutation. Audit any external module allowlists for prefix-matching weaknesses.