CVE-2026-92957: CVE-2026-92957: Sandbox Escape and Remote Code Execution in vm2 via node: Prefix Policy Bypass

CVE-2026-92957 is a critical vulnerability in the vm2 sandbox package, specifically the NodeVM component, that allows sandboxed code to bypass security policies and execute arbitrary system commands. This issue affects versions of vm2 up to and including 3.11.6, with version 3.11.7 containing the necessary fix.

The vulnerability arises due to a failure in the parser to recognize exemptions in negative built-in module deny lists when using the 'node:' prefix. For example, a config like -node:child_process fails to register the exemption as expected, allowing the host's child_process module to be loaded and executed. This effectively grants the ability to run arbitrary system commands on the host system, leading to a remote code execution (RCE) scenario.

Attackers can exploit this through a Proof of Concept (PoC) currently available. The CVSS score for this vulnerability is 9.9 (Critical) according to CVSS v3.1 and 9.4 (Critical) as per CVSS v4.0. This makes it one of the most serious vulnerabilities affecting the vm2 sandbox.

The exploit has not yet been publicly demonstrated, but the CVSS scores and the nature of the flaw indicate that it could be developed into a practical attack in due course. The vulnerability exists in vm2 sandbox environments, specifically those running versions 3.11.6 or earlier. The fix was introduced in version 3.11.7, where the parser now correctly normalizes the 'node:' prefix in negative deny tokens, thus preventing the silent exposure of host modules.

To mitigate this vulnerability, users are advised to upgrade to version 3.11.7 or later. Additionally, configurations that rely on wildcard require policies with negative deny tokens should be reviewed and modified. It is recommended to explicitly define a strict allowlist of required modules instead of using wildcard rules combined with exemptions. This approach helps ensure that only the necessary modules are accessible, reducing the risk of sandbox escape and RCE attacks.