CVE-2026-93605

Summary

This vulnerability allows attackers to escape the sandbox and execute arbitrary commands on the host system by exploiting the DANGEROUS_BUILTINS denylist in vm2 NodeVM versions before 3.12.1.

Exploitability

Exploitation is relatively straightforward if the attacker can influence the configuration to include child_process in the allowed builtins.

Blast radius

If exploited, this can lead to complete compromise of the host system, including data theft, system damage, and further lateral movement.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to vm2 NodeVM 3.12.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.