{"action":"Upgrade vm2 to 3.11.7 or later.","affected":[{"fixed":"3.11.7","introduced":"0"}],"component":"vm2","cve_ids":["CVE-2026-92957"],"ecosystem":"npm","epss":0.00537,"exploited":false,"fixed_versions":["3.11.7"],"ghsa_id":"GHSA-8686-vhfx-7r3j","id":"tcs_01M5KFBY7GADV94T2AVMQCKRR4","modified_at":"2026-10-01T15:45:05.646511674Z","published_at":"2026-10-01T15:36:01Z","references":["https://osv.dev/vulnerability/GHSA-8686-vhfx-7r3j","https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j","https://nvd.nist.gov/vuln/detail/CVE-2026-92957","https://github.com/patriksimek/vm2/commit/b0f50662dd499ff33544bb42387958c64711af1e","https://github.com/patriksimek/vm2","https://github.com/patriksimek/vm2/releases/tag/v3.11.7","https://www.vulncheck.com/advisories/vm2-before-3.11.7-authentication-bypass-via-node-prefix"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-8686-vhfx-7r3j","url":"https://osv.dev/vulnerability/GHSA-8686-vhfx-7r3j"}],"summary":"vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process"}