{"uuid": "654c58ac-8a8b-45c1-9df9-fe29d4babd70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92958", "type": "seen", "source": "https://gist.github.com/alon710/22e8b5c6cbd0f2ab19371081f5579e5c", "content": "# CVE-2026-92958: CVE-2026-92958: Built-in Module Denylist Bypass via fs/promises in vm2 NodeVM Subsystem\n\n> **CVSS Score:** 8.5\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-92958\n\n## Summary\nCVE-2026-92958 is a high-severity sandbox escape and denylist bypass vulnerability within the NodeVM subsystem of the vm2 sandboxing library. When configuring wildcards with negative deny entries, exact-string matches fail to block subpaths like fs/promises. Sandboxed code can import these subpaths to bypass isolation and execute arbitrary filesystem operations on the host.\n\n## TL;DR\nA denylist bypass vulnerability in vm2 <= 3.11.6 allows sandboxed code to bypass security rules by importing unblocked subpath modules like fs/promises, enabling arbitrary write access to the host filesystem.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-269\n- **Attack Vector**: Network\n- **CVSS v3.1**: 8.5\n- **EPSS Score**: 0.00384\n- **Exploit Status**: PoC\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- vm2 Node.js sandboxing library\n- **vm2**: <= 3.11.6 (Fixed in: `3.11.7`)\n\n## Mitigation\n\n- Upgrade the vm2 package to version 3.11.7 or higher.\n- Manually list all subpath modules in the deny list of NodeVM if upgrading is not immediately possible.\n- Migrate away from the deprecated vm2 library to stronger isolation runtimes such as WebAssembly or Docker containers.\n\n**Remediation Steps:**\n1. Run 'npm install vm2@3.11.7' to apply the update.\n2. Audit existing NodeVM initialization configurations to ensure negative rules include both parent and subpath modules.\n3. Validate the sandbox constraints using automated test suites.\n\n## References\n\n- [https://github.com/patriksimek/vm2/security/advisories/GHSA-6rh5-qq4q-97xh](https://github.com/patriksimek/vm2/security/advisories/GHSA-6rh5-qq4q-97xh)\n- [https://github.com/patriksimek/vm2/commit/59d35f68e52a9bd229a8a72bcd9274bd4cec2bc5](https://github.com/patriksimek/vm2/commit/59d35f68e52a9bd229a8a72bcd9274bd4cec2bc5)\n- [https://github.com/patriksimek/vm2/releases/tag/v3.11.7](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)\n- [https://www.vulncheck.com/advisories/vm2-before-3.11.7-denylist-bypass-via-fs-promises](https://www.vulncheck.com/advisories/vm2-before-3.11.7-denylist-bypass-via-fs-promises)\n- [https://www.cve.org/CVERecord?id=CVE-2026-92958](https://www.cve.org/CVERecord?id=CVE-2026-92958)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-92958](https://nvd.nist.gov/vuln/detail/CVE-2026-92958)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-92958) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-02T03:30:30.000000Z"}