{"items":[{"id":"NVI-00013125","kind":"vulnerability","title":"vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jxxv-8r27-vm4p","CVE-2026-92950"],"plain_summary":"GitHub lists this reviewed advisory for vm2. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6a597a5982dcabf3f9c1eb15caaec292"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-01T15:40:47.000Z","value":"8.6 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6a597a5982dcabf3f9c1eb15caaec292"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6a597a5982dcabf3f9c1eb15caaec292","url":"https://github.com/advisories/GHSA-jxxv-8r27-vm4p","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-jxxv-8r27-vm4p","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T01:40:00.567Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6a597a5982dcabf3f9c1eb15caaec292"],"technology":"vm2","known_exclusions":[],"conditions_summary":"### Summary\nThe `vm2` command-line tool installed by `npm install -g vm2` and documented in the README's \"CLI\" section runs the supplied script under `NodeVM` with `require:{external:true}` and no `root` / `context` / `builtin` configured. With these defaults the resolver loads every relative or absolute `require()` target through the **host** `require()` function, executing the attacker's module body in the host Node.js process before the result is ever proxied back into the sandbox. A single attacker-controlled file passed to `vm2 ./script.js` can call `require(__filename)` to re-execute itself in host realm and reach `fs`, `child_process`, etc. The documented sandbox runner is therefore equivalent to `node ./script.js`. No additional files, flags, or user interaction are required.\n\n### Details\nThe vulnerability lets a **malicious sandboxed script** - the file argument to the documented `vm2 ` CLI - execute arbitrary code in the **host Node.js process**, crossing the sandbox → host boundary that vm2 is meant to enforce.\n\n#### Vulnerable code path\n\n1. **Source** - `bin/vm2:3` → `lib/cli.js:7-18`. `process.argv[2]` is the\n   attacker-authored script path. The CLI invokes:\n   ","public_affected_ranges":["<= 3.11.6"]}],"null_published_at":"2026-11-01T07:29:12.924Z","source_updated_at":"2026-10-01T15:40:47.000Z","source_disclosed_at":"2026-10-01T15:40:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T01:40:00.567Z"}],"next_cursor":null,"snapshot_revision":"42594"}