Description
vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| patriksimek | vm2 | < 3.12.1 | 3.12.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | vm2 | < 3.12.1 | 3.12.1 | GHSA-pq68-rvw4-xp4r |
Advisories 1
- WID-SEC-2026-3189 vm2: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Oct 27, 2026
References
- GitHub Security Advisory (GHSA-pq68-rvw4-xp4r) vendor-advisory
- VulnCheck Advisory: vm2 NodeVM before 3.12.1 Remote Code Execution via child_process third-party-advisory