vm2 NodeVM Sandbox Escape via child_process (CVE-2026-93605)

Technical Analysis

CVE-2026-93605 affects vm2 NodeVM configurations using builtin:['*'] or explicit child_process allowance, where the DANGEROUS_BUILTINS denylist omits child_process despite blocking comparable host-spawning modules like fs and net. An attacker with the ability to execute JavaScript inside the sandbox can call require('child_process') to spawn shell processes, achieving full arbitrary command execution on the underlying host with the privileges of the sandboxing process. This is a logic flaw in the denylist implementation rather than a memory-safety issue, making exploitation trivial and reliable once sandbox code execution is achieved. Because vm2 is commonly used to sandbox plugin code, user scripts, and LLM-generated or tool-invoked code snippets, this vulnerability is especially dangerous for AI agent frameworks that execute untrusted or model-generated JavaScript in vm2-based sandboxes as part of code-interpreter or tool-use features, potentially allowing prompt-injected or malicious model output to escape sandboxing and compromise the host running the agent.

Affected Systems

Node.js applications using vm2 NodeVM versions prior to 3.12.1, specifically those configured with builtin:['*'] or explicit allowance of the child_process module; includes plugin systems, code-execution sandboxes, serverless function runners, and AI agent code-interpreter tools built on vm2.

Indicators of Compromise

• N/A - logic vulnerability, no known malware signatures; monitor for unexpected child_process spawning from Node.js sandbox worker processes
• Suspicious require('child_process') calls originating from sandboxed VM contexts
• Unexpected shell command execution (e.g., /bin/sh, cmd.exe) spawned by Node.js processes hosting vm2

Remediation Steps

1. 1

   Upgrade vm2

   Update vm2 to version 3.12.1 or later, which patches the DANGEROUS_BUILTINS denylist to include child_process.

2. 2

   Restrict builtins explicitly

   Avoid using builtin:['*'] wildcard configuration; explicitly allowlist only the minimal set of builtins required and exclude child_process, fs, net, and similar host-interacting modules.

3. 3

   Migrate away from vm2 if unmaintained

   Consider migrating to actively maintained isolation solutions (e.g., isolated-vm, worker threads with strict permission models, or OS-level sandboxing like gVisor/Firecracker) given vm2's history of sandbox escape CVEs.

4. 4

   Audit AI agent code-execution features

   For AI agent or LLM tool-use systems that execute generated code via vm2, audit configurations immediately and add process-level sandboxing (containers, seccomp, restricted service accounts) as defense-in-depth against sandbox escapes.

5. 5

   Monitor host process spawning

   Deploy runtime monitoring (EDR/auditd) to detect anomalous child process creation from Node.js processes hosting vm2 sandboxes.