CVE-2026-92935
1 advisory.
npm/vm2 CVE-2026-92935: critical 9, EPSS 0.67%
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
Action: Upgrade vm2 to 3.11.7 or later.
npm i vm2@3.11.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.11.4 | 3.11.7 | - |
Fixed versions
| 3.11.7 |
Sources
- osv: GHSA-8hr7-r645-pc6w
- https://github.com/patriksimek/vm2/security/advisories/GHSA-8hr7-r645-pc6w
- https://nvd.nist.gov/vuln/detail/CVE-2026-92935
- https://github.com/patriksimek/vm2/commit/05894eca1dc6a2b1a986f312c88255288a983d22
- https://github.com/patriksimek/vm2/commit/54b54b74a382577f0bcd0538c5bf99acdcd7f53b
- https://github.com/patriksimek/vm2
- https://github.com/patriksimek/vm2/releases/tag/v3.11.7
- https://www.vulncheck.com/advisories/vm2-nodevm-remote-code-execution-via-array-shaped-require
CVE-2026-92935 · published · modified · JSON