CVE-2026-92950: Sandbox Escape Vulnerability in vm2 CLI

The vm2 library is a widely deployed Node.js library used to execute untrusted code in a sandboxed, isolated execution environment. To ensure isolation, vm2 wraps JavaScript execution frames using proxy objects and custom resolvers to intercept sensitive API calls. This sandboxing is critical for applications that process untrusted user-supplied code, such as online code editors or automated execution systems.

Prior to version 3.11.7, the global command-line interface tool supplied with vm2 contains a significant security configuration flaw. When running a targeted script through the CLI execution path, the runner instantiates an instance of the NodeVM engine with permissive external module options. This module resolution configuration is vulnerable to a sandbox escape that grants complete shell access to the host environment.

This specific bug class maps to CWE-453 (Insecure Default Variable Initialization). By executing arbitrary commands with the privileges of the executing process, an attacker can fully compromise the underlying host operating system. The vulnerability presents an immediate path to local privilege escalation or container escape if the CLI tool runs within a containerized environment.

The root cause of CVE-2026-92950 lies in how the vm2 command-line utility instantiates the sandboxed NodeVM instance in lib/cli.js. The CLI tool sets the require.external flag to true to allow sandboxed modules to import external dependencies. However, it fails to define the require.root property and leaves require.context unconfigured, causing it to fall back to the default 'host' evaluation context.

Within the vm2 library, the class CustomResolver (implemented in lib/resolver-compat.js) manages permissions for imported file paths. The resolution logic evaluates paths using a helper function called isPathAllowed. When require.root is undefined, the internal rootPaths array is also initialized as undefined, causing the resolver to permit any absolute or relative path without restriction.

Simultaneously, the 'host' evaluation context dictates that permitted modules must be loaded using the host process's native require() function rather than being evaluated within the sandbox context. Under these specific conditions, the resolver intercepts module queries and safely resolves the absolute path of the target script, but then hands the path over to Node's native module loader. Because native execution happens entirely in the host realm, the sandbox execution boundary is bypassed.

A review of the vulnerable implementation in lib/cli.js demonstrates the omission of restricting properties during the VM setup. The initialization configures external: true without constraining the root path or context:

// Vulnerable configuration in lib/cli.js (Pre-3.11.7)
NodeVM.file(path, {
    verbose: true,
    require: {
        external: true
    }
});

In the patch released in version 3.11.7, the developers explicitly declared the root property as the parent directory of the script and set the execution context to 'sandbox' to block native module execution. The fix constrains imports and compiles them inside the safe sandbox wrapper:

// Patched configuration in lib/cli.js (v3.11.7)
NodeVM.file(path, {
    verbose: true,
    require: {
        external: true,
        // Explicitly set the root boundary to the target directory
        root: pa.dirname(path),
        // Enforce script execution inside the sandbox realm
        context: 'sandbox'
    }
});

Furthermore, defense-in-depth measures were introduced in the resolution module to prevent nested escape routes. The update introduces the isVm2SelfRequire helper to block sandboxed scripts from loading vm2 itself. Without this block, an attacker could load the library from disk and generate unrestricted nested engines to execute commands on the host.

Exploitation of CVE-2026-92950 relies on a nested-import technique often referred to as a "self-require" primitive. An attacker crafts a malicious JavaScript file designed to run under dual execution phases. During the initial execution phase, the script runs within the sandboxed environment where calls to high-privilege built-in modules like fs or child_process fail.

When these calls fail and throw exceptions, the catch block intercepts the error and executes the escape payload. The script triggers a call to require(__filename), pointing directly back to its own file path on the host filesystem. Because the module root boundary is unrestricted and the resolution context is 'host', the custom resolver authorizes the native Node.js engine to load the file.

Upon the second execution phase, Node.js resolves and runs the script from the top using the host's native environment. This grants the script unrestricted access to the host's global context. The second execution successfully accesses the native fs and child_process modules, allowing arbitrary shell command execution with the privileges of the host process.

To completely address the vulnerability, administrators must upgrade the vm2 dependency to version 3.11.7 or higher. Organizations utilizing the CLI tool globally should execute updates to purge vulnerable versions from their global NPM configurations. It is important to note that the vm2 project has been officially deprecated by its maintainers due to structural design limitations within single-process Node.js sandbox systems.

For applications that instantiate NodeVM dynamically in code, developer teams must implement robust configuration policies. Never enable require.external without specifying a restricted require.root path. Enforcing context: 'sandbox' is also required to prevent the loading of modules inside the native host execution frame.

If immediate patching or replacement is not possible, security teams must deploy detection rules to identify exploit attempts. Monitor process creation events originating from Node.js applications that execute untrusted code. Deploying system-level controls like AppArmor or SELinux can block unauthorized system calls if an attacker successfully escapes the runtime sandbox.