CVE-2026-92948

vm2 versions = 3.9.6 and therefore executes arbitrary JavaScript in an unrestricted host Node process outside the NodeVM sandbox. Fixed in vm2 3.11.7...

CVE-2026-92948

vm2 (a Node.js sandboxing library) versions 3.9.6 through 3.11.6 are vulnerable to a sandbox escape on Node.js 24+ when the embedder explicitly allows the node:test builtin. On Node.js 24, module.builtinModules exposes the scheme-only key node:test, which bypasses vm2's DANGEROUS_BUILTINS family-...

CVE-2026-92948 vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test

vm2 versions = 3.9.6 and therefore executes arbitrary JavaScript in an unrestricted host Node process outside the NodeVM sandbox. Fixed in vm2 3.11.7...

EUVD-2026-81597

vm2 versions = 3.9.6 and therefore executes arbitrary JavaScript in an unrestricted host Node process outside the NodeVM sandbox. Fixed in vm2 3.11.7...

CVE-2026-92948 vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test

vm2 versions = 3.9.6 and therefore executes arbitrary JavaScript in an unrestricted host Node process outside the NodeVM sandbox. Fixed in vm2 3.11.7...