Vulnerabilities
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent (Critical severity, CVE-2026-92940)
A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.
vm2
Everything Threat Times has reported about vm2: 10 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape (Critical severity, CVE-2026-92948)
A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.
Vulnerabilities
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process (Critical severity, CVE-2026-92957)
A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.
Vulnerabilities
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package (Critical severity, CVE-2026-92951)
A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.
Vulnerabilities
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection (Critical severity, CVE-2026-92937)
A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.
Vulnerabilities
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE (Critical severity, CVE-2026-92935)
A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.
Vulnerabilities
vm2 NodeVM can replace the host process TLS trust store (Critical severity, CVE-2026-92941)
A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.
Vulnerabilities
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector (Critical severity, CVE-2026-92944)
A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.
Vulnerabilities
vm2 crypto builtin loads attacker native code through setEngine (Critical severity, CVE-2026-92939)
A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.
Vulnerabilities
vm2 allows a sandboxed plugin to execute native code through `node:sqlite` (Critical severity, CVE-2026-92938)
A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.