CVE-2026-93605: vm2 NodeVM Sandbox Escape RCE Vulnerability

CVE-2026-93605 is a sandbox escape vulnerability in vm2 NodeVM that enables remote code execution through child_process access. Attackers can execute arbitrary commands on the host system when builtins are misconfigured. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-93605 Overview

CVE-2026-93605 is a sandbox escape vulnerability in the vm2 NodeVM library affecting all versions before 3.12.1. The library's DANGEROUS_BUILTINS denylist fails to include the child_process module, despite explicitly blocking other host-spawning modules. Attackers who can execute code inside a NodeVM sandbox configured with builtin:['*'] or with child_process explicitly allowed can require the module and spawn arbitrary processes on the host. The flaw is categorized under CWE-693: Protection Mechanism Failure and enables full remote code execution against any application relying on vm2 for untrusted code isolation.

Critical Impact
Attackers escape the vm2 sandbox and execute arbitrary operating system commands with the privileges of the host Node.js process.

Affected Products

vm2 NodeVM versions prior to 3.12.1
Node.js applications embedding vm2 for untrusted code execution
Serverless and plugin platforms that expose vm2 sandboxes with broad builtin allowlists

Discovery Timeline

2026-09-18 - CVE-2026-93605 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-93605

Vulnerability Analysis

The vm2 library provides a sandboxed Node.js environment where hosts can restrict access to built-in modules through the builtin option. To prevent obvious escapes, vm2 maintains a DANGEROUS_BUILTINS internal denylist that overrides caller configuration and blocks modules capable of executing host commands or loading native code.

The denylist covers modules such as those enabling native addon loading but omits child_process. When a host constructs a NodeVM with builtin:['*'] or explicitly permits child_process, the sandbox's require implementation returns the real module. Sandboxed code then calls exec, execSync, spawn, or fork and runs arbitrary commands outside the sandbox.

The vulnerability is fully network-exploitable in any deployment that accepts untrusted scripts, including plugin runners, code-evaluation APIs, and low-code automation platforms. No authentication or user interaction is required when the sandboxed endpoint is exposed.

Root Cause

The root cause is an incomplete protection mechanism. The DANGEROUS_BUILTINS list was designed as the last line of defense against host-reachable modules, but child_process was never added. The library trusts the caller-supplied builtin option for that module, so a permissive configuration silently exposes command execution primitives to sandboxed code.

Attack Vector

An attacker submits JavaScript to any application that evaluates it inside a vulnerable vm2 NodeVM. Inside the sandbox, the payload calls require('child_process') and invokes execSync or spawn with attacker-controlled arguments. The commands execute as the Node.js process user, giving the attacker file system access, network egress, and the ability to stage further payloads. Refer to the GitHub Security Advisory GHSA-pq68-rvw4-xp4r and the VulnCheck Remote Code Execution Advisory for technical details.

Detection Methods for CVE-2026-93605

Indicators of Compromise

Node.js processes spawning unexpected child processes such as sh, bash, cmd.exe, powershell.exe, or curl when the parent hosts a vm2 sandbox.
Outbound network connections from Node.js workers to unfamiliar IPs or paste sites shortly after sandboxed job execution.
Application logs showing sandboxed jobs referencing child_process, execSync, or spawn string literals.

Detection Strategies

Inventory package-lock.json and yarn.lock files across build and runtime hosts for vm2 versions below 3.12.1.
Instrument the sandbox host to log every require call resolved from within a NodeVM context, alerting when child_process is requested.
Correlate parent-child process relationships to flag Node.js parents spawning shell interpreters, which is atypical for sandboxed workloads.

Monitoring Recommendations

Enable EDR process-tree monitoring on Node.js hosts and alert on shell or LOLBin children of node processes running vm2.
Forward Node.js stderr and structured application logs to a centralized platform and search for child_process invocation patterns.
Monitor egress traffic from application tiers for anomalous destinations following untrusted code submissions.

How to Mitigate CVE-2026-93605

Immediate Actions Required

Upgrade vm2 to version 3.12.1 or later in every affected service and rebuild container images.
Audit every NodeVM instantiation and remove builtin:['*'] and explicit child_process entries from the allowlist.
Restrict which users or API clients can submit code to sandboxed endpoints until patched builds are deployed.

Patch Information

The maintainers addressed the issue in vm23.12.1 by adding child_process to the DANGEROUS_BUILTINS denylist. Consumers should update via npm install vm2@3.12.1 or the equivalent yarn command and verify the resolved version in lockfiles. Review the GitHub Security Advisory GHSA-pq68-rvw4-xp4r for the official fix notes. Note that the upstream vm2 project has been deprecated in favor of isolated-vm; teams should plan migration to a maintained sandbox.

Workarounds

Explicitly pass a minimal builtin array that excludes child_process and any module not required by sandboxed code.
Run the Node.js host process as an unprivileged user inside a container with seccomp and no-new-privileges to limit post-escape impact.
Wrap NodeVM execution in a separate worker or child process with strict CPU, memory, and network egress controls.