{"uuid": "dadc86b2-1f7a-4e1b-9a3b-e4f128e1c4aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92951", "type": "seen", "source": "https://gist.github.com/alon710/23bc679610f5c645e780cc942955cea8", "content": "# CVE-2026-92951: CVE-2026-92951: Sandbox Escape via External Package Allowlist Bypass in vm2\n\n> **CVSS Score:** 9.9\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-92951\n\n## Summary\nAn incorrect authorization and directory traversal vulnerability in the vm2 library before version 3.11.7 allows remote attackers to bypass the sandbox's external package allowlist. This flaw permits sandboxed code to resolve and execute arbitrary packages available on the host filesystem under host privileges, leading to unauthenticated sandbox escape and host code execution.\n\n## TL;DR\nA flaw in vm2's bare-specifier matcher allowlist check allows sandbox escape. It uses unanchored substring matching and fails to filter directory traversal sequences, allowing untrusted code to load and execute arbitrary host packages with full authority.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-706, CWE-863, CWE-829\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.9 (Critical)\n- **Exploit Status**: Proof of Concept (PoC) documented in test suite\n- **CISA KEV Status**: Not Listed\n- **EPSS Score**: 0.00539\n- **Impact**: Complete Sandbox Escape & Host Code Execution\n\n## Affected Systems\n\n- Applications executing untrusted code using vm2 NodeVM configurations\n- Multi-tenant plugin hosting systems relying on vm2 external module allowlists\n- Serverless runtimes and webhooks using deprecated vm2 sandbox instances\n- **vm2**: < 3.11.7 (Fixed in: `3.11.7`)\n\n## Mitigation\n\n- Upgrade vm2 to version 3.11.7 or later where the boundaries of external matchers are strictly anchored and traversal sequences are rejected.\n- Migrate to robust isolation mechanisms such as isolates (e.g., isolated-vm), WebAssembly (WASM) runtimes, or containerized execution.\n- Implement strong OS-level sandboxing (such as AppArmor, gVisor, or Docker with non-root configurations) to limit the damage of an escape.\n\n**Remediation Steps:**\n1. Identify all direct and transitive dependencies on the 'vm2' package in your project's lockfile.\n2. Update the package.json dependency for 'vm2' to '^3.11.7'.\n3. Run your package manager's installation command (e.g., 'npm install' or 'yarn install') to apply the patch.\n4. Verify that the compiled regex mappings inside 'lib/resolver-compat.js' match the anchored patterns.\n\n## References\n\n- [GHSA-c48m-32m9-vx93](https://github.com/patriksimek/vm2/security/advisories/GHSA-c48m-32m9-vx93)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-custom-resolver)\n- [NVD - CVE-2026-92951](https://nvd.nist.gov/vuln/detail/CVE-2026-92951)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-92951) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-02T02:30:32.000000Z"}