Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-93604— vm2 3.11.8 Sandbox Escape via crypto.setFips

Quick assessment

Affected

patriksimek vm2

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

vm2 在 3.12.0 及之前版本中存在一个漏洞：当嵌入器明确将内置模块添加到 NodeVM 的白名单（即设置）时，Node.js 的函数会被暴露给不受信任的来宾（guest）代码。内置模块的净化函数（位于中的）虽然替换了，但遗漏了对的防护，使其仍可被调用。此外，用于暴露宿主模块的只读包装器（readonly wrapper）未能隔离被转发的宿主函数的副作用。因此，来宾代码可以调用来改变整个宿主进程的 FIPS 模式；这一变更随后会被受信任的宿主代码观察到（在报告的测试中，的值从 0 变为

CVSS 7.2 · High EPSS 0.34% · P28 Updated Sep 18, 2026

Possible ATT&CK Techniques 2 AI

T1611 · Escape to Host T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
patriksimek	vm2	`< 3.12.1`	affected
		`3.12.1`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

vm2 3.11.8 Sandbox Escape via crypto.setFips

Source: CVE Program / CVE List V5

Vulnerability Description

vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM (require.builtin: ['crypto']). The builtin sanitizer (sanitizeCryptoModule in lib/builtin.js) replaces crypto.setEngine but leaves crypto.setFips callable, and the readonly wrapper used to expose the host module does not localize side effects of forwarded host functions. Guest code can therefore call crypto.setFips() to change the FIPS mode of the entire host process; the modified mode is subsequently observed by trusted host code (crypto.getFips() changed from 0 to 1 in the reported test), crossing the NodeVM isolation boundary. Fixed in vm2 3.12.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

访问控制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
patriksimek	vm2	0 ~ 3.12.1	-

II. Public POCs for CVE-2026-93604

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-93604

请登录查看更多情报信息。

Other References for CVE-2026-93604 (2)

🔗 NodeVM crypto sanitizer exposes process-wide crypto.setFips · Advisory · patriksimek/vm2 · GitHub Read full article vendor-advisory
🔗 vm2 3.11.8 Sandbox Escape via crypto.setFips | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-93604

Same Patch Batch · patriksimek · 2026-09-18 · 4 CVEs total

CVE-2026-93603	10.0 CRITICAL	vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function
CVE-2026-93605	10.0 CRITICAL	vm2 NodeVM before 3.12.1 Remote Code Execution via child_process
CVE-2026-93606	10.0 CRITICAL	vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species

IV. Related Vulnerabilities

Same product: vm2

Same vendor: patriksimek

Same weakness: CWE-284