Is CVE-2026-93603 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93603 being exploited in the wild.

How severe is CVE-2026-93603?

Critical severity, with a CVSS score of 10, published 18 September 2026.

Which products and versions are affected?

Patriksimek vm2 through 3.12.0.

Is there a fix for CVE-2026-93603?

A patch was published on 2026-09-18: Fixed in version 3.12.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93603 attacked?

It is attacked over the network.

Am I affected by CVE-2026-93603?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93603: vm2 sandbox escape via nullish this receiver

CVE-2026-93603 · Severity: critical · CVSS 10 · Published 2026-09-18

vm2 is a JavaScript sandbox library used to safely execute untrusted code in an isolated environment. A critical flaw allows attackers to break out of the sandbox and gain full control of the host system when the embedding application exposes any ordinary (non-strict) function to sandboxed code. An attacker can invoke such functions without a proper receiver context, causing the host's global object to leak back into the sandbox, from which they can access the Node.js process object and execute arbitrary commands on the host machine.

Quick answers

Is CVE-2026-93603 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93603 being exploited in the wild.
How severe is CVE-2026-93603?: Critical severity, with a CVSS score of 10, published 18 September 2026.
Which products and versions are affected?: Patriksimek vm2 through 3.12.0.
Is there a fix for CVE-2026-93603?: A patch was published on 2026-09-18: Fixed in version 3.12.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93603 attacked?: It is attacked over the network.
Am I affected by CVE-2026-93603?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a sandbox escape in vm2's bridge mechanism (lib/bridge.js) caused by improper handling of nullish `this` receivers in the apply trap. When sandboxed code calls a host-provided non-strict function without a receiver (e.g., bare call `fn()`, detached method, `fn.call()`, `fn.apply(undefined)`, `Reflect.apply(fn, undefined, [])`, or `fn.bind()()`), the undefined receiver is passed through to the host function call. V8 then substitutes the host realm's global object as `this`, which vm2 wraps and returns to the sandbox as a live proxy. This grants the attacker direct access to the host global object and, critically, to `process.getBuiltinModule('child_process').execSync()` for arbitrary code execution. The attack requires that the embedding application expose at least one non-strict host function to the sandbox; strict-mode and ES module host functions are not affected. A patch is available in version 3.12.1, which replaces nullish receivers with a cached host-realm null-prototype object before invoking the host function, preventing the global object from being exposed.

Affected products

Patriksimek vm2 through 3.12.0

Timeline

2026-09-18: disclosed
2026-09-18: patched: Fixed in version 3.12.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.