vm2 before 3.11.7 Sandbox Escape via CLI require

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-92950 · Microsoft / collected KEV context

EUVD-2026-81599

GHSA-hc6q-4vvg-jf79

GHSA-jxxv-8r27-vm4p

cve-program · CVE-2026-92950

• https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require

euvd · EUVD-2026-81599

• https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require

nvd · CVE-2026-92950

• https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require

osv · GHSA-hc6q-4vvg-jf79

• https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p
• https://nvd.nist.gov/vuln/detail/CVE-2026-92950
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require

osv · GHSA-jxxv-8r27-vm4p

• https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p
• https://nvd.nist.gov/vuln/detail/CVE-2026-92950
• https://github.com/patriksimek/vm2/commit/903017c8a1eae9aba947ec854468b48155e79f86
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.7
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require

• vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename)… · Advisory content revised · 1 Nov 2026