vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS
    denylist omits child_process despite blocking other host-spawning modules. Attackers can require
    child_process and execute arbitrary commands on the host system when NodeVM is configured with
    builtin:['*'] or explicit child_process allowance. (CVE-2026-93605)

ID	Name	Product	Family	Type	Severity
474004	Echo: vm2: security update to 3.12.1	Tenable Cloud Security	Echo Local Security Checks	Local	critical
474004	Echo: vm2: security update to 3.12.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
473666	SCA: security update for vm2 (GHSA-pq68-rvw4-xp4r)	Tenable Cloud Security	SCA Checks	Local	critical
473666	SCA: security update for vm2 (GHSA-pq68-rvw4-xp4r)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-93605

critical

Tenable Plugins

critical

critical

critical

critical