EUVD-2026-82900

vm2 contains a sandbox escape vulnerability...

CVE-2026-93605 vm2 NodeVM before 3.12.1 Remote Code Execution via child_process

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUSBUILTINS denylist omits childprocess despite blocking other host-spawning modules. Attackers can require childprocess and execute arbitrary commands on the host system when NodeVM is configured with...

PT-2026-95384

Name of the Vulnerable Software and Affected Versions vm2 NodeVM versions prior to 3.12.1 Description A sandbox escape exists because the DANGEROUS BUILTINS denylist fails to include child process, even though other modules capable of spawning host processes are blocked. This allows attackers to...