CVE-2026-93603

vm2 (Node.js sandbox library) through 3.12.0 is vulnerable to a complete sandbox escape due to incorrect handling of a nullish this receiver in the apply trap of its bridge (lib/bridge.js). When sandboxed code invokes a host-provided non-strict (sloppy-mode) function without a receiver (e.g., fn(...