CVE-2026-92948
Description
A flaw was found in vm2. This vulnerability allows an attacker with permission to run code inside the sandbox to escape containment and achieve arbitrary code execution on the host system. Due to improper validation of built-in module names, the sandbox fails to block access to sensitive host functions. An attacker can exploit this issue by supplying a specially crafted module identifier, allowing them to spawn an unrestricted process on the host.
Statement
An important-impact sandbox escape affects the vm2 JavaScript sandbox library as shipped in Red Hat Ansible Automation Platform 2.1 and 2.2 (automation-portal and bootc-automation-portal-rhel9 containers) and Red Hat Developer Hub 1.9 and 1.10 (rhdh-hub-rhel9 and the orchestrator and lightspeed backend plugin containers). In vm2 versions 3.9.6 through 3.11.6, built-in module names are not properly validated, so the sandbox fails to block access to sensitive host functions. On Node.js 24 and later, when an embedder explicitly allows the node:test built-in in the NodeVM configuration, sandboxed code can obtain a proxy to the host node:test module by requesting it with a doubled 'node:' prefix and then call its run() function with attacker-controlled execArgv options such as --eval; the host implementation spawns a separate unrestricted Node.js process, resulting in arbitrary code execution on the host outside the sandbox with the full permissions of the embedding user. Exploitation requires the attacker to already be able to run code inside the sandbox, requires the embedder to have explicitly allowlisted the node:test built-in, and is only reachable on Node.js 24 or newer. Because of these preconditions, Red Hat rates the impact of this flaw as important even though the CVSS 3.1 base score (9.9) maps to critical severity, matching the upstream severity rating. Fixes for the affected product streams are being pursued through the responsible Red Hat product teams under delegated resolution.
Mitigation
This flaw is only reachable when the NodeVM sandbox configuration explicitly allows the node:test built-in and the application runs on Node.js 24 or later. As a workaround, remove node:test from the allowed builtins in the vm2 sandbox configuration (for example, drop it from the require.builtin allowlist), or run the embedding application on a Node.js version where the scheme-only node:test entry is not exposed (the exploit path is not present on Node.js 22). If test functionality must be exposed to sandboxed code, provide a sandbox-local wrapper using vm2's mock or override options that does not expose run(), process isolation, execArgv, or other host process controls. Otherwise, update to a build containing the fix: upstream vm2 is fixed in version 3.11.7, and updates for the affected Red Hat Ansible Automation Platform and Red Hat Developer Hub streams are available through the respective product releases.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9.9 | N/A | 9.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
