CVE-2026-92957
Description
A flaw was found in vm2. Untrusted code running within the sandbox can bypass module restriction policies to achieve arbitrary code execution on the underlying host. Due to improper normalization of module names containing the node: prefix, deny-list rules fail to prevent access to sensitive built-in modules such as child_process. An attacker can exploit this vulnerability to escape the sandbox and execute commands directly on the host system.
Statement
This vulnerability is rated as an Important impact for Red Hat products because an attacker capable of submitting sandboxed scripts can bypass module deny-list restrictions and execute arbitrary commands in the host container environment. While achieving process execution from within a sandbox is a critical security bypass, the rating is kept at Important because exploitation requires authenticated or configured access to execute untrusted code and the blast radius is bounded by the container runtime. Affected components across Red Hat Developer Hub and Red Hat Ansible Automation Platform bundle vm2 for script isolation, leaving backend service environments vulnerable if untrusted input is evaluated.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9.9 | N/A | 9.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
