CVE-2026-92948: Protection Mechanism Failure

vm2 versions = 3.9.6 and = 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the node:test builtin e.g. require: builtin: 'node:test' . On Node.js 24+, module.builtinModules exposes the scheme-only ke...