vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-92948 · Microsoft / collected KEV context

EUVD-2026-81597

GHSA-wqg3-r97q-73xm

GHSA-qhwx-74w5-xhxq

cve-program · CVE-2026-92948

• https://github.com/patriksimek/vm2/security/advisories/GHSA-qhwx-74w5-xhxq
• https://www.vulncheck.com/advisories/vm2-3.9.6-through-3.11.5-sandbox-escape-via-node-test

euvd · EUVD-2026-81597

• https://github.com/patriksimek/vm2/security/advisories/GHSA-qhwx-74w5-xhxq
• https://www.vulncheck.com/advisories/vm2-3.9.6-through-3.11.5-sandbox-escape-via-node-test

nvd · CVE-2026-92948

• https://github.com/patriksimek/vm2/security/advisories/GHSA-qhwx-74w5-xhxq
• https://www.vulncheck.com/advisories/vm2-3.9.6-through-3.11.5-sandbox-escape-via-node-test

osv · GHSA-qhwx-74w5-xhxq

• https://github.com/patriksimek/vm2/security/advisories/GHSA-qhwx-74w5-xhxq
• https://nvd.nist.gov/vuln/detail/CVE-2026-92948
• https://github.com/patriksimek/vm2/commit/415339f698f0d52d3c5ad358b12b79c8072d5b4b
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.7
• https://www.vulncheck.com/advisories/vm2-3.9.6-through-3.11.5-sandbox-escape-via-node-test

osv · GHSA-wqg3-r97q-73xm

• https://github.com/patriksimek/vm2/security/advisories/GHSA-qhwx-74w5-xhxq
• https://nvd.nist.gov/vuln/detail/CVE-2026-92948
• https://www.vulncheck.com/advisories/vm2-3.9.6-through-3.11.5-sandbox-escape-via-node-test

• vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the node:test builtin (e.g. require: { builtin: ['node:test'] })… · Advisory content revised · 1 Nov 2026