patriksimek vm2 up to 3.11.6 Require Configuration makeResolverFromLegacyOptions require sandbox

Summaryinfo

A vulnerability, which was classified as critical, has been found in patriksimek vm2 up to 3.11.6. The impacted element is the function makeResolverFromLegacyOptions of the component Require Configuration. This manipulation of the argument require causes sandbox. This vulnerability is registered as CVE-2026-92935. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in patriksimek vm2 up to 3.11.6 and classified as critical. Affected by this vulnerability is the function makeResolverFromLegacyOptions of the component Require Configuration. The manipulation of the argument require with an unknown input leads to a sandbox vulnerability. The CWE definition for the vulnerability is CWE-265. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' && requireOpts !== null`, so an array-shaped `require` value (for example `require: []`) satisfies the guard that is meant to reject nesting without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array into undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy `nesting` and an array-shaped `require` (e.g. `new NodeVM({nesting: true, require: []})`) can require the host `vm2` module, create an inner NodeVM with an attacker-chosen builtin allowlist (such as `child_process`), and execute arbitrary commands with the privileges of the host Node.js process, escaping the sandbox. Outer builtin restrictions do not constrain the attacker-created inner NodeVM. This issue is fixed in vm2 3.11.7.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-92935 since 09/17/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1611 according to MITRE ATT&CK.

Upgrading to version 3.11.7 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• patriksimek

Name

• vm2

Version

• 3.11.0
• 3.11.1
• 3.11.2
• 3.11.3
• 3.11.4
• 3.11.5
• 3.11.6

Website

• Product: https://github.com/patriksimek/vm2/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion