CVE-2026-93605— vm2 NodeVM before 3.12.1 Remote Code Execution via child_process
Quick assessment
Affected
patriksimek vm2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host syst
Possible ATT&CK Techniques 3 AI
T1203 · Exploitation for Client Execution T1059.004 · Unix Shell T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93605
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
vm2 NodeVM before 3.12.1 Remote Code Execution via child_process
Source: CVE Program / CVE List V5
Vulnerability Description
vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| patriksimek | vm2 | 0 ~ 3.12.1 | - |
|
II. Public POCs for CVE-2026-93605
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93605
请登录查看更多情报信息。
Other References for CVE-2026-93605 (2)
Same Patch Batch · patriksimek · 2026-09-18 · 4 CVEs total
| CVE-2026-93603 | 10.0 CRITICAL | vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function |
| CVE-2026-93606 | 10.0 CRITICAL | vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species |
| CVE-2026-93604 | 7.2 HIGH | vm2 3.11.8 Sandbox Escape via crypto.setFips |
IV. Related Vulnerabilities
Same product: vm2
-
CVE-2026-93606
vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species -
CVE-2026-93604
vm2 3.11.8 Sandbox Escape via crypto.setFips -
CVE-2026-93603
vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Fun -
CVE-2026-92963
vm2 before 3.11.2 Information Disclosure via Internal State -
CVE-2026-92962
vm2 before 3.11.4 Defense Invariant Violation via setup-sand
Same vendor: patriksimek
-
CVE-2026-93606
vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species -
CVE-2026-93604
vm2 3.11.8 Sandbox Escape via crypto.setFips -
CVE-2026-93603
vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Fun -
CVE-2026-92963
vm2 before 3.11.2 Information Disclosure via Internal State -
CVE-2026-92962
vm2 before 3.11.4 Defense Invariant Violation via setup-sand
Same weakness: CWE-693
-
CVE-2026-93606
vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species -
CVE-2026-92962
vm2 before 3.11.4 Defense Invariant Violation via setup-sand -
CVE-2026-92959
vm2 before 3.11.8 allowAsync Bypass via Promise Thenable -
CVE-2026-92956
vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.com -
CVE-2026-92948
vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test
V. Comments for CVE-2026-93605
No comments yet