GHSA-9hxx-m5g2-2q3h

Duplicate Advisory: vm2 contains a sandbox escape vulnerability

Published

2026-09-18

Modified

2026-10-07

Sources

github-advisory

Summary

# Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pq68-rvw4-xp4r. This link is maintained to preserve external references. # Original Description vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.

Affected packages

Remediation: Upgrade to 3.12.1 or later.

References

• https://github.com/advisories/GHSA-9hxx-m5g2-2q3h