vm2 before 3.11.7 Sandbox Escape via CLI require

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92950 · CVE overview and exploitation status

EUVD-2026-81599

GHSA-hc6q-4vvg-jf79

GHSA-jxxv-8r27-vm4p

cve-program · CVE-2026-92950

• https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require

euvd · EUVD-2026-81599

• https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require

nvd · CVE-2026-92950

• https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require

osv · GHSA-hc6q-4vvg-jf79

• https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p
• https://nvd.nist.gov/vuln/detail/CVE-2026-92950
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require

osv · GHSA-jxxv-8r27-vm4p

• https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p
• https://nvd.nist.gov/vuln/detail/CVE-2026-92950
• https://github.com/patriksimek/vm2/commit/903017c8a1eae9aba947ec854468b48155e79f86
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.7
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require

• vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename)… · Advisory content revised · 1 Nov 2026