{"uuid": "b6f2d65e-81cd-4bb9-be80-4a4e4929b30a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92957", "type": "seen", "source": "https://gist.github.com/alon710/3af588ed2efbcf8f9595610df593dce1", "content": "# CVE-2026-92957: CVE-2026-92957: Sandbox Escape and Remote Code Execution in vm2 via node: Prefix Policy Bypass\n\n> **CVSS Score:** 9.9\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-92957\n\n## Summary\nA vulnerability in the NodeVM component of the vm2 sandbox package through version 3.11.6 allows sandboxed code to bypass security policies restricting access to built-in modules. When a wildcard require policy is configured with negative deny entries using the 'node:' prefix (e.g., '-node:child_process'), the parser fails to recognize the exemption due to exact string comparison. As a result, the unmitigated module is registered, allowing sandboxed code to import the host child_process module and execute arbitrary system commands.\n\n## TL;DR\nvm2 fails to normalize the 'node:' prefix in negative builtin policy entries, allowing sandboxed code to load disallowed modules like 'child_process' and achieve remote code execution on the host.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-269\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.9 (Critical)\n- **CVSS v4.0 Score**: 9.4 (Critical)\n- **EPSS Score**: 0.00537 (43.14th percentile)\n- **Exploit Maturity**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- vm2 sandbox environments running version 3.11.6 or earlier\n- **vm2**: <= 3.11.6 (Fixed in: `3.11.7`)\n\n## Mitigation\n\n- Upgrade the vm2 package to version 3.11.7 or later to resolve the prefix normalization error.\n- Avoid wildcard configurations with negative exclusions. Instead, explicitly define a strict allowlist containing only the minimal set of required modules.\n- Migrate existing sandboxed execution flows away from vm2 to alternative isolation boundaries such as WebAssembly runtimes or containerized processes.\n\n**Remediation Steps:**\n1. Identify all projects and configurations utilizing the vm2 package.\n2. Review configuration files initializing NodeVM, locating any occurrences of wildcard require policies containing negative deny tokens (e.g., 'builtin: [\"*\", \"-node:...\"]').\n3. Update package.json dependencies to target 'vm2': '^3.11.7'. Run npm install or yarn install to apply the patch.\n4. If upgrading is not immediately possible, rewrite the NodeVM options block to explicitly allow only specific safe built-in libraries (e.g., builtin: ['path', 'url']) and avoid using wildcard rules combined with exemptions.\n\n## References\n\n- [GitHub Security Advisory GHSA-8686-vhfx-7r3j](https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j)\n- [VulnCheck Advisory for vm2 Node Prefix Bypass](https://www.vulncheck.com/advisories/vm2-before-3.11.7-authentication-bypass-via-node-prefix)\n- [CVE Record JSON Data](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92957.json)\n- [NVD CVE-2026-92957 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-92957)\n- [CVE.org CVE-2026-92957 Record](https://www.cve.org/CVERecord?id=CVE-2026-92957)\n- [Fix Commit b0f5066](https://github.com/patriksimek/vm2/commit/b0f50662dd499ff33544bb42387958c64711af1e)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-92957) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-02T04:30:31.000000Z"}