CVE-2026-92950
High · 8.6CVSS
8.6
EPSS
0.2%
Published
Sep 17, 2026
CISA due date
—
The record
vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-109828 A vulnerability was found in libsndfile up to 1.2.2. CWE-453
- CVE-2026-41330 OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host… CWE-453
- GHSA-9gp8-hjxr-6f34 OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls CWE-453