CVE-2026-92957— vm2 before 3.11.7 Authentication Bypass via node: Prefix
Quick assessment
Affected
patriksimek vm2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
vm2 版本 3.11.6 及更早版本在评估 NodeVM 通配符 require 策略中用户提供的负向（拒绝）条目时，未能对带有 前缀的内建模块说明符进行归一化处理。尽管 NodeVM 在解析 调用时会剥离 前缀，但负向通配符条目是通过对规范化的内建模块名称进行精确字符串比较来进行匹配的。因此，诸如 这样的策略无法成功拒绝规范化的 模块。 这意味着沙盒内的代码可以通过 或 获取宿主机的 内建模块，从而获得对进程生成 API（如 和 ）的引用。这相当于为不受信任的沙盒代码提供了在宿主机上执行命令的能力。 该问题已在
Possible ATT&CK Techniques 1 AI
T1204.002 · Malicious File
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92957
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
vm2 before 3.11.7 Authentication Bypass via node: Prefix
Source: CVE Program / CVE List V5
Vulnerability Description
vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, negative wildcard entries are matched by exact string comparison against the canonical builtin names, so a policy such as `new NodeVM({ require: { builtin: ['*', '-node:child_process'] } })` fails to deny the canonical `child_process` module. Sandboxed code can therefore obtain the host `child_process` builtin via `require('child_process')` or `require('node:child_process')`, gaining references to process-spawning APIs such as execSync and spawn, which is equivalent to host command-execution capability for untrusted sandbox code. Fixed in vm2 3.11.7. (Suggested title: "vm2 before 3.11.7: NodeVM builtin deny-list bypass via node:-prefixed specifiers exposes child_process")
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| patriksimek | vm2 | 0 ~ 3.11.7 | - |
|
II. Public POCs for CVE-2026-92957
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92957
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-92957 (2)
-
-
🔗 vm2 before 3.11.7 Authentication Bypass via node: Prefix | Advisories | VulnCheck third-party-advisory
Same Patch Batch · patriksimek · 2026-09-17 · 30 CVEs total
| CVE-2026-92946 | 10.0 CRITICAL | vm2 before 3.11.7 Remote Code Execution via require.external |
| CVE-2026-92940 | 10.0 CRITICAL | vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent |
| CVE-2026-92955 | 10.0 CRITICAL | vm2 before 3.11.8 Sandbox Escape via NodeVM |
| CVE-2026-92953 | 10.0 CRITICAL | vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray |
| CVE-2026-92956 | 10.0 CRITICAL | vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming |
| CVE-2026-92937 | 10.0 CRITICAL | vm2 3.11.6 Remote Code Execution via Promise call/apply |
| CVE-2026-92960 | 10.0 CRITICAL | vm2 before 3.11.6 Process-wide State Exposure via os and dns |
| CVE-2026-92941 | 10.0 CRITICAL | vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation |
| CVE-2026-92947 | 10.0 CRITICAL | vm2 before 3.11.7 Memory Disclosure via Buffer Pool |
| CVE-2026-92938 | 9.9 CRITICAL | vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite |
| CVE-2026-92951 | 9.9 CRITICAL | vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver |
| CVE-2026-92939 | 9.9 CRITICAL | vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine |
| CVE-2026-92948 | 9.9 CRITICAL | vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test |
| CVE-2026-92944 | 9.8 CRITICAL | vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector |
| CVE-2026-92935 | 9.0 CRITICAL | vm2 NodeVM Remote Code Execution via Array-Shaped Require |
| CVE-2026-92934 | 9.0 CRITICAL | vm2 before 3.11.8 Sandbox Escape RCE via AggregateError |
| CVE-2026-92954 | 8.6 HIGH | vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise |
| CVE-2026-92950 | 8.6 HIGH | vm2 before 3.11.7 Sandbox Escape via CLI require |
| CVE-2026-92958 | 8.5 HIGH | vm2 before 3.11.7 Denylist Bypass via fs/promises |
| CVE-2026-92942 | 7.5 HIGH | vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: vm2
-
CVE-2026-92963
vm2 before 3.11.2 Information Disclosure via Internal State -
CVE-2026-92962
vm2 before 3.11.4 Defense Invariant Violation via setup-sand -
CVE-2026-92961
vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit -
CVE-2026-92960
vm2 before 3.11.6 Process-wide State Exposure via os and dns -
CVE-2026-92959
vm2 before 3.11.8 allowAsync Bypass via Promise Thenable
Same vendor: patriksimek
-
CVE-2026-92963
vm2 before 3.11.2 Information Disclosure via Internal State -
CVE-2026-92962
vm2 before 3.11.4 Defense Invariant Violation via setup-sand -
CVE-2026-92961
vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit -
CVE-2026-92960
vm2 before 3.11.6 Process-wide State Exposure via os and dns -
CVE-2026-92959
vm2 before 3.11.8 allowAsync Bypass via Promise Thenable
Same weakness: CWE-269
V. Comments for CVE-2026-92957
No comments yet