CRITICALCVSS 9.4

GHSA-wqg3-r97q-73xm

Duplicate Advisory: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

Published: 2026-09-17
Modified: 2026-10-01
Sources: github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qhwx-74w5-xhxq. This link is maintained to preserve external references. ## Original Description vm2 versions >= 3.9.6 and therefore executes arbitrary JavaScript in an unrestricted host Node process outside the NodeVM sandbox. Fixed in vm2 3.11.7.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
npm	vm2	—	—

Remediation: No patched version is listed by GitHub.

References

https://github.com/advisories/GHSA-wqg3-r97q-73xm

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.