External risk intelligence

vm2 Module Allowlist Bypass via Substring Matching

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-92951

vm2 is a sandboxing library used by developers within Node.js applications to execute untrusted code. It is a build-time or runtime component integrated into software rather than a standalone internet-facing service, appliance, or gateway. Exposure depends entirely on whether a specific application exposes a sandbox feature to the internet, which is not a common or default deployment pattern.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the vm2 sandboxing library, potentially allowing unauthorized code execution within applications that use it. The core issue lies in how vm2 validates external packages, enabling attackers to bypass security checks by exploiting how package names are matched. While the direct business impact is uncertain without knowing specific implementations, any use of vm2 warrants a review of its configuration.

Code could be tricked into running unwanted packages.
Critical vulnerability in a sandboxing tool.
Confirm if this tool is used in your systems.

Attack Path

How an attacker could exploit the issue

An attacker can bypass security checks within the vm2 sandboxing library by exploiting how it validates external packages. This is achieved by using a package name that includes a permitted package as a substring, tricking vm2 into loading and executing unauthorized code within the host environment. This could allow an attacker to gain access to sensitive information or disrupt the application's normal operation.

Requires authenticated access.
Triggers when loading unauthorized packages.
Leads to unauthorized host code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in vm2 could allow an attacker to bypass security controls and load unauthorized host packages, leading to the execution of unintended code within the host context. This may occur when the affected software processes package names that contain allowlisted substrings but are not exact matches.

Unauthorized host packages could be loaded.
Non-exact substring matching can be bypassed.
Untrusted code may execute on the host.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vm2 library's vulnerability requires investigation by teams responsible for Node.js application development and security, particularly those integrating untrusted code execution. The first step is to inventory all applications using vm2, determine if the vulnerable functionality is exposed externally, and assess business criticality before planning remediation.

Application owners should own the issue.
Verify vm2 usage and external reachability.
Plan remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the vm2 library?

vm2 is a JavaScript sandboxing library for Node.js. Developers use it to safely run untrusted code by isolating it from the main application. It acts as an internal component embedded within software to provide a secure execution environment, rather than serving as a standalone internet-facing service or server.

What does CVE-2026-92951 mean?

This vulnerability is an incorrect authorization issue, classified as CWE-706. The library fails to perform strict boundary checks when validating which external packages are allowed to run. Because it relies on simple substring matching instead of exact names, it creates a security loophole that allows unauthorized packages to be loaded and executed.

How can an attacker trigger this vulnerability?

An attacker needs the ability to supply or influence the code processed by the sandbox. By requesting a specially crafted package name that contains an allowlisted package name as a substring, they can trick the sandbox into loading unauthorized host packages. Simply using the library normally without this specific collision tactic does not trigger the flaw.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as very unlikely to be directly reachable from the internet. vm2 is an embedded component, not a service. Your actual risk depends on whether your specific Node.js application is designed to expose its sandbox features to external users, which is not a common or default configuration for most software.

What should I do if my applications use vm2?

Start by identifying every application in your environment that includes the vm2 library. Evaluate whether those applications allow untrusted code execution from sources accessible to external users. Once you understand where it is used, coordinate with your development teams to review your package configurations and prioritize updates to a version beyond 3.11.7.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.