CVE-2026-93605

Name of the Vulnerable Software and Affected Versions vm2 NodeVM versions prior to 3.12.1

Description A sandbox escape exists because the DANGEROUS BUILTINS denylist fails to include child process, even though other modules capable of spawning host processes are blocked. This allows attackers to require child process and execute arbitrary commands on the host system if NodeVM is configured with builtin:['*'] or if child process is explicitly allowed.

Recommendations Update vm2 NodeVM to version 3.12.1 or later.