{"id":"CVE-2026-92935","aliases":["CLSA-2026-1790888247","EUVD-2026-81585","GHSA-8686-vhfx-7r3j","GHSA-8hr7-r645-pc6w","GHSA-9fxx-mv6c-j5xp","ROOT-APP-NPM-CVE-2026-92935"],"status":"published","title":"vm2 NodeVM Remote Code Execution via Array-Shaped Require","description":"vm2 is a sandbox for running untrusted Node.js code. In versions \u003e= 3.11.4 and \u003c= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' \u0026\u0026 requireOpts !== null`, so an array-shaped `require` value (for example `require: []`) satisfies the guard that is meant to reject nesting without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array into undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy `nesting` and an array-shaped `require` (e.g. `new NodeVM({nesting: true, require: []})`) can require the host `vm2` module, create an inner NodeVM with an attacker-chosen builtin allowlist (such as `child_process`), and execute arbitrary commands with the privileges of the host Node.js process, escaping the sandbox. Outer builtin restrictions do not constrain the attacker-created inner NodeVM. This issue is fixed in vm2 3.11.7.","severity":{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00636,"percentile":0.50834,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-913"],"published":"2026-09-17T13:46:00Z","modified":"2026-10-28T02:31:01Z","exploits":[{"source":"pocgithub","id":"CompleteTech-Security/vm2-nesting-check","title":"CompleteTech-Security/vm2-nesting-check","date":"2026-10-23","url":"https://github.com/CompleteTech-Security/vm2-nesting-check"}],"fixes":[{"ecosystem":"npm","package":"vm2","fixed_in":["3.11.7"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"vm2","fixed_in":["3.11.6-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/vm2","fixed_in":["3.11.6-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.4"},{"last_affected":"3.11.6"},{"fixed":"3.11.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.5-tuxcare.0"},{"fixed":"3.11.5-tuxcare.3"}]}],"versions":["3.11.5","3.11.5-tuxcare.1","3.11.5-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"npm","package":"vm2","ranges":[{"type":"SEMVER","events":[{"introduced":"3.11.4"},{"fixed":"3.11.7"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.6-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.6-root.io.1"}]}]}],"products":[{"vendor":"patriksimek","product":"vm2"}],"references":[{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-8hr7-r645-pc6w","tags":["vendor-advisory","advisory","web"]},{"url":"https://github.com/patriksimek/vm2/commit/54b54b74a382577f0bcd0538c5bf99acdcd7f53b","tags":["patch","fix","web"]},{"url":"https://www.vulncheck.com/advisories/vm2-nodevm-remote-code-execution-via-array-shaped-require","tags":["third-party-advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92935","tags":["advisory"]},{"url":"https://github.com/patriksimek/vm2/commit/05894eca1dc6a2b1a986f312c88255288a983d22","tags":["web"]},{"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8hr7-r645-pc6w"},{"url":"https://github.com/advisories/GHSA-9fxx-mv6c-j5xp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92935.json","tags":["advisory"]},{"url":"https://github.com/patriksimek/vm2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-92935","title":"vm2 NodeVM Remote Code Execution via Array-Shaped Require","description":"vm2 is a sandbox for running untrusted Node.js code. In versions \u003e= 3.11.4 and \u003c= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' \u0026\u0026 requireOpts !== null`, so an array-shaped `require` value (for example `require: []`) satisfies the guard that is meant to reject nesting without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array into undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy `nesting` and an array-shaped `require` (e.g. `new NodeVM({nesting: true, require: []})`) can require the host `vm2` module, create an inner NodeVM with an attacker-chosen builtin allowlist (such as `child_process`), and execute arbitrary commands with the privileges of the host Node.js process, escaping the sandbox. Outer builtin restrictions do not constrain the attacker-created inner NodeVM. This issue is fixed in vm2 3.11.7.","status":"published","published":"2026-09-17T13:46:00.854Z","modified":"2026-09-17T19:21:04.162Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T13:48:35.749498Z"}],"euvd":[{"id":"EUVD-2026-81585","description":"vm2 is a sandbox for running untrusted Node.js code. In versions \u003e= 3.11.4 and \u003c= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' \u0026\u0026 requireOpts !== null`, so an array-shaped `require` value (for example `require: []`) satisfies the guard that is meant to reject nesting without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array into undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy `nesting` and an array-shaped `require` (e.g. `new NodeVM({nesting: true, require: []})`) can require the host `vm2` module, create an inner NodeVM with an attacker-chosen builtin allowlist (such as `child_process`), and execute arbitrary commands with the privileges of the host Node.js process, escaping the sandbox. Outer builtin restrictions do not constrain the attacker-created inner NodeVM. This issue is fixed in vm2 3.11.7.","status":"published","published":"2026-09-17T13:46:00Z","modified":"2026-09-17T19:21:04Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T17:28:10.042182Z"}],"ghsa":[{"id":"GHSA-8hr7-r645-pc6w","title":"vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE","description":"## Summary\n\nThe `NodeVM` constructor computes `hasRealRequireConfig` using `typeof requireOpts === 'object' \u0026\u0026 requireOpts !== null`, so `require: []` bypasses the guard intended to reject `nesting` without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array to undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. Any attacker whose JavaScript is executed by a downstream `NodeVM` configured with `{nesting: true, require: []}` can load the host `vm2` module, create an inner `NodeVM` with an attacker-selected builtin allowlist, and execute commands as the host process. No equivalent plain-object validation exists in `makeResolverFromLegacyOptions()`.\n\nArray is converted into the vm2-only resolver:\nhttps://github.com/patriksimek/vm2/blob/54b54b74a382577f0bcd0538c5bf99acdcd7f53b/lib/resolver-compat.js#L205-L226\n\nNesting loader returns the host VM constructors:\nhttps://github.com/patriksimek/vm2/blob/54b54b74a382577f0bcd0538c5bf99acdcd7f53b/lib/nodevm.js#L640-L645\n\n## Proof of Concept\n\nPreconditions:\n\n- The host creates `NodeVM` with truthy `nesting` and array-shaped `require`.\n- The attacker can supply JavaScript executed by that `NodeVM`.\n\n```javascript\n'use strict';\n\nconst {NodeVM} = require('./index.js');\n\nconst outer = new NodeVM({nesting: true, require: []});\nconst result = outer.run(`\n\tconst {NodeVM} = require('vm2');\n\tconst inner = new NodeVM({require: {builtin: ['child_process']}});\n\tmodule.exports = inner.run(\n\t\t\"module.exports = require('child_process').execSync('id').toString()\"\n\t);\n`);\n\nconsole.log(result);\n```\n\n```text\nuid=1000(lohar) gid=1000(lohar) groups=1000(lohar)\n```\n\nThe `hasRealRequireConfig` guard fails open because it returns `true` for arrays, although arrays are not `VMRequire` configuration objects. `makeResolverFromLegacyOptions()` applies object destructuring to the array, obtains undefined `builtin` and `external` values, merges `NESTING_OVERRIDE`, and returns before any external-module control is relevant. Outer builtin restrictions do not constrain the attacker-created inner `NodeVM`, whose `require` configuration is selected inside the sandbox.\n\nFailed shape check:\nhttps://github.com/patriksimek/vm2/blob/54b54b74a382577f0bcd0538c5bf99acdcd7f53b/lib/nodevm.js#L304-L307\n\n## Impact\n\nAn attacker can execute arbitrary commands with the host Node.js process privileges, including reading secrets, modifying files, and accessing the host network. GHSA-m4wx-m65x-ghrr covers the same nesting primitive but does not cover array-shaped `require` values and incorrectly identifies 3.11.4 as patched. \n\n\u003e Exploitation is limited to downstream applications that enable `nesting` and pass the malformed array configuration.","status":"published","published":"2026-10-01T15:34:58Z","modified":"2026-10-01T15:35:00Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T14:41:24.739884Z"},{"id":"GHSA-9fxx-mv6c-j5xp","title":"Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-8hr7-r645-pc6w. This link is maintained to preserve external references.\n\n## Original Description\nvm2 is a sandbox for running untrusted Node.js code. In versions \u003e= 3.11.4 and \u003c= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' \u0026\u0026 requireOpts !== null`, so an array-shaped `require` value (for example `require: []`) satisfies the guard that is meant to reject nesting without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array into undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy `nesting` and an array-shaped `require` (e.g. `new NodeVM({nesting: true, require: []})`) can require the host `vm2` module, create an inner NodeVM with an attacker-chosen builtin allowlist (such as `child_process`), and execute arbitrary commands with the privileges of the host Node.js process, escaping the sandbox. Outer builtin restrictions do not constrain the attacker-created inner NodeVM. This issue is fixed in vm2 3.11.7.","status":"withdrawn","published":"2026-09-17T15:32:14Z","modified":"2026-10-01T15:32:42Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T14:41:24.739884Z"}],"nvd":[{"id":"CVE-2026-92935","description":"vm2 is a sandbox for running untrusted Node.js code. In versions \u003e= 3.11.4 and \u003c= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' \u0026\u0026 requireOpts !== null`, so an array-shaped `require` value (for example `require: []`) satisfies the guard that is meant to reject nesting without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array into undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy `nesting` and an array-shaped `require` (e.g. `new NodeVM({nesting: true, require: []})`) can require the host `vm2` module, create an inner NodeVM with an attacker-chosen builtin allowlist (such as `child_process`), and execute arbitrary commands with the privileges of the host Node.js process, escaping the sandbox. Outer builtin restrictions do not constrain the attacker-created inner NodeVM. This issue is fixed in vm2 3.11.7.","status":"published","published":"2026-09-17T14:17:57.81Z","modified":"2026-09-17T20:18:59.093Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T14:12:49.013904Z"}],"osv":[{"id":"CVE-2026-92935","title":"vm2 NodeVM Remote Code Execution via Array-Shaped Require","description":"vm2 is a sandbox for running untrusted Node.js code. In versions \u003e= 3.11.4 and \u003c= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' \u0026\u0026 requireOpts !== null`, so an array-shaped `require` value (for example `require: []`) satisfies the guard that is meant to reject nesting without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array into undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy `nesting` and an array-shaped `require` (e.g. `new NodeVM({nesting: true, require: []})`) can require the host `vm2` module, create an inner NodeVM with an attacker-chosen builtin allowlist (such as `child_process`), and execute arbitrary commands with the privileges of the host Node.js process, escaping the sandbox. Outer builtin restrictions do not constrain the attacker-created inner NodeVM. This issue is fixed in vm2 3.11.7.","status":"published","published":"2026-09-17T13:46:00.854Z","modified":"2026-10-28T02:31:01.764132131Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T15:45:20.588039Z"},{"id":"GHSA-8hr7-r645-pc6w","title":"vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE","description":"## Summary\n\nThe `NodeVM` constructor computes `hasRealRequireConfig` using `typeof requireOpts === 'object' \u0026\u0026 requireOpts !== null`, so `require: []` bypasses the guard intended to reject `nesting` without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array to undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. Any attacker whose JavaScript is executed by a downstream `NodeVM` configured with `{nesting: true, require: []}` can load the host `vm2` module, create an inner `NodeVM` with an attacker-selected builtin allowlist, and execute commands as the host process. No equivalent plain-object validation exists in `makeResolverFromLegacyOptions()`.\n\nArray is converted into the vm2-only resolver:\nhttps://github.com/patriksimek/vm2/blob/54b54b74a382577f0bcd0538c5bf99acdcd7f53b/lib/resolver-compat.js#L205-L226\n\nNesting loader returns the host VM constructors:\nhttps://github.com/patriksimek/vm2/blob/54b54b74a382577f0bcd0538c5bf99acdcd7f53b/lib/nodevm.js#L640-L645\n\n## Proof of Concept\n\nPreconditions:\n\n- The host creates `NodeVM` with truthy `nesting` and array-shaped `require`.\n- The attacker can supply JavaScript executed by that `NodeVM`.\n\n```javascript\n'use strict';\n\nconst {NodeVM} = require('./index.js');\n\nconst outer = new NodeVM({nesting: true, require: []});\nconst result = outer.run(`\n\tconst {NodeVM} = require('vm2');\n\tconst inner = new NodeVM({require: {builtin: ['child_process']}});\n\tmodule.exports = inner.run(\n\t\t\"module.exports = require('child_process').execSync('id').toString()\"\n\t);\n`);\n\nconsole.log(result);\n```\n\n```text\nuid=1000(lohar) gid=1000(lohar) groups=1000(lohar)\n```\n\nThe `hasRealRequireConfig` guard fails open because it returns `true` for arrays, although arrays are not `VMRequire` configuration objects. `makeResolverFromLegacyOptions()` applies object destructuring to the array, obtains undefined `builtin` and `external` values, merges `NESTING_OVERRIDE`, and returns before any external-module control is relevant. Outer builtin restrictions do not constrain the attacker-created inner `NodeVM`, whose `require` configuration is selected inside the sandbox.\n\nFailed shape check:\nhttps://github.com/patriksimek/vm2/blob/54b54b74a382577f0bcd0538c5bf99acdcd7f53b/lib/nodevm.js#L304-L307\n\n## Impact\n\nAn attacker can execute arbitrary commands with the host Node.js process privileges, including reading secrets, modifying files, and accessing the host network. GHSA-m4wx-m65x-ghrr covers the same nesting primitive but does not cover array-shaped `require` values and incorrectly identifies 3.11.4 as patched. \n\n\u003e Exploitation is limited to downstream applications that enable `nesting` and pass the malformed array configuration.","status":"published","published":"2026-10-01T15:34:58Z","modified":"2026-10-01T15:45:06.195893388Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"GHSA-9fxx-mv6c-j5xp","title":"Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-8hr7-r645-pc6w. This link is maintained to preserve external references.\n\n## Original Description\nvm2 is a sandbox for running untrusted Node.js code. In versions \u003e= 3.11.4 and \u003c= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' \u0026\u0026 requireOpts !== null`, so an array-shaped `require` value (for example `require: []`) satisfies the guard that is meant to reject nesting without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array into undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy `nesting` and an array-shaped `require` (e.g. `new NodeVM({nesting: true, require: []})`) can require the host `vm2` module, create an inner NodeVM with an attacker-chosen builtin allowlist (such as `child_process`), and execute arbitrary commands with the privileges of the host Node.js process, escaping the sandbox. Outer builtin restrictions do not constrain the attacker-created inner NodeVM. This issue is fixed in vm2 3.11.7.","status":"withdrawn","published":"2026-09-17T15:32:14Z","modified":"2026-10-01T15:45:06.73636893Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"CLSA-2026-1790888247","title":"TuxCare security update for vm2 (15 CVEs)","description":"TuxCare rebuilt vm2 to address 15 CVEs. Fixed in 3.11.5-tuxcare.3.","status":"published","published":"2026-10-01T20:57:27Z","modified":"2026-10-15T09:47:57.771844817Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"ROOT-APP-NPM-CVE-2026-92935","title":"CVE-2026-92935 in vm2 - Patched by Root","description":"Root has patched CVE-2026-92935 in the vm2 package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-19T07:16:29Z","modified":"2026-10-19T08:15:07.354865624Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}