vm2 NodeVM before 3.12.1 Remote Code Execution via child_process

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-93605 · Microsoft / collected KEV context

EUVD-2026-82900

GHSA-9hxx-m5g2-2q3h

GHSA-pq68-rvw4-xp4r

cve-program · CVE-2026-93605

• https://github.com/patriksimek/vm2/security/advisories/GHSA-pq68-rvw4-xp4r
• https://www.vulncheck.com/advisories/vm2-nodevm-before-3.12.1-remote-code-execution-via-child-process

euvd · EUVD-2026-82900

• https://github.com/patriksimek/vm2/security/advisories/GHSA-pq68-rvw4-xp4r
• https://www.vulncheck.com/advisories/vm2-nodevm-before-3.12.1-remote-code-execution-via-child-process

nvd · CVE-2026-93605

• https://github.com/patriksimek/vm2/security/advisories/GHSA-pq68-rvw4-xp4r
• https://www.vulncheck.com/advisories/vm2-nodevm-before-3.12.1-remote-code-execution-via-child-process

osv · GHSA-9hxx-m5g2-2q3h

• https://github.com/patriksimek/vm2/security/advisories/GHSA-pq68-rvw4-xp4r
• https://nvd.nist.gov/vuln/detail/CVE-2026-93605
• https://www.vulncheck.com/advisories/vm2-nodevm-before-3.12.1-remote-code-execution-via-child-process

osv · GHSA-pq68-rvw4-xp4r

• https://github.com/patriksimek/vm2/security/advisories/GHSA-pq68-rvw4-xp4r
• https://nvd.nist.gov/vuln/detail/CVE-2026-93605
• https://github.com/patriksimek/vm2
• https://www.vulncheck.com/advisories/vm2-nodevm-before-3.12.1-remote-code-execution-via-child-process

• vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary comma… · Advisory content revised · 1 Nov 2026