Open-source package vulnerability · npm

GHSA-9hxx-m5g2-2q3h: Duplicate Advisory: vm2 contains a sandbox escape vulnerability

criticalCVSS 4.0 10.0 · 3.1 10.0

This advisory was withdrawn on Oct 7, 2026. The publisher no longer considers it a valid vulnerability.

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pq68-rvw4-xp4r. This link is maintained to preserve external references. Original Description vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUSBUILTINS denylist omits childprocess despite blocking other host-spawning modules.

Published Sep 18, 2026 · Updated Oct 7, 2026

Affected packages

vm2

Ecosystem: npm
Affected: < 3.12.1
Fixed in: 3.12.1
Check: npm ls vm2

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-pq68-rvw4-xp4r. This link is maintained to preserve external references.

Original Description

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.

Credited to portyu9.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More npm vulnerabilities

All npm entries