{"uuid": "86e20cf8-6e49-46ae-9ed2-26efa7ac4edf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92950", "type": "seen", "source": "https://gist.github.com/alon710/cffd9fb26c4b181fc044cd8b7ed2ee26", "content": "# CVE-2026-92950: CVE-2026-92950: Sandbox Escape Vulnerability in vm2 CLI\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-92950\n\n## Summary\nCVE-2026-92950 (GHSA-jxxv-8r27-vm4p) is a critical sandbox escape vulnerability in the command-line interface of the vm2 library prior to version 3.11.7. The flaw allows untrusted scripts to bypass sandbox constraints and execute arbitrary system commands with the privileges of the host process by exploiting insecure default configurations of the module resolver.\n\n## TL;DR\nA design flaw in the vm2 CLI tool permits sandboxed code to load local files in the host execution realm, resulting in a complete sandbox escape and unauthenticated arbitrary command execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-453 (Insecure Default Variable Initialization)\n- **Attack Vector**: Local\n- **CVSS v4.0 Score**: 9.3 (Critical)\n- **EPSS Score**: 0.00197 (8.53rd Percentile)\n- **Exploit Status**: Proof-of-Concept Publicly Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- vm2 CLI (npm package)\n- **vm2**: < 3.11.7 (Fixed in: `3.11.7`)\n\n## Mitigation\n\n- Upgrade the vm2 library to version 3.11.7 or higher.\n- Configure NodeVM instances with a explicitly specified require.root directory.\n- Set require.context to 'sandbox' to enforce compilation boundaries within the VM.\n- Migrate to runtime containerization or process-level isolation models.\n\n**Remediation Steps:**\n1. Identify all global and local installations of the vm2 npm package.\n2. Run 'npm install vm2@3.11.7' or update package.json dependencies to target >=3.11.7.\n3. Audit custom NodeVM configuration code to verify that require.external is not used without require.root.\n4. Validate remediation by testing custom modules against the self-require exploit pattern.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-92950)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-92950) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-02T00:30:30.000000Z"}