CVE-2026-92950

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.7

Description A sandbox escape exists in the CLI tool that enables arbitrary code execution within the host Node.js process. An attacker can provide a malicious script file to the CLI that utilizes require( filename) to re-execute itself in the host realm. This action bypasses sandbox isolation, granting unauthorized access to host modules such as fs and child process.

Recommendations Update vm2 to version 3.11.7 or later.