exploit · Thu 01 Oct 2026 · 15:41 UTC
GHSA-qhwx-74w5-xhxq: vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
Filed UTCSource GTH ↗
On Node.js 24 and newer, vm2 can expose the host node:test module to sandboxed NodeVM code when the embedder explicitly allows the node:test builtin. Sandbox code can reach that module through require('node:node:test') and call run() with attacker-controlled execArgv. node:test.run() starts a separate Node process for process-isolated test execution and forwards the supplied execArgv values to that process. Supplying --eval= therefore executes arbitrary JavaScript in an unrestricted host Node process, outside the NodeVM sandbox. …
Signals
as the pipeline stamped them- High
- Critical vulnerability — CVSS 9.9
- What to do
- Critical severity — schedule an urgent patch.
CVE
KEV from CISA · EPSS from FIRST| Id | KEV | EPSS | Reference |
|---|---|---|---|
| CVE-2026-92948 | — | 0.65% | NVD ↗ |
Indicators
checking abuse.ch ThreatFoxChecking indicators against ThreatFox…
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.