Executive brief
vm2 is a JavaScript sandbox engine used to safely run untrusted code in an isolated environment. This vulnerability allows sandboxed code to bypass filesystem access restrictions and directly access fs/promises, enabling attackers to create and modify files on the host system despite the embedder explicitly denying fs access. Organizations using vm2 to sandbox user-submitted code or plugins face direct data exposure and system compromise risks.
Technical details
The vulnerability is a denylist bypass in NodeVM's builtin module filtering (lib/builtin.js). When using a wildcard policy (e.g., require: { builtin: ['*', '-fs', '-child_process'] }), negative entries are matched by exact module name only. This means -fs blocks only the fs module itself but not fs/promises or node:fs/promises. Additionally, the node: prefix handling is inconsistent—negative entries like -node:fs/promises do not block require('fs/promises'). An attacker with code execution in the sandbox can call require('fs/promises') to access the promise-based filesystem API, then use methods like fsp.writeFile(), mkdir, rm, and others to read/write/modify files on the host. The attack requires no additional privileges or user interaction. This issue is fixed in vm2 3.11.7.
Affected products
- vm2 vm2 through 3.11.6
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory GHSA-6rh5-qq4q-97xh published
- 2026-09-17: advisory: CVE-2026-92958 published
- 2026: patched: Fixed in vm2 3.11.7