CVE-2026-93605
Description
A flaw was found in vm2. The sandbox environment fails to restrict access to the child_process module, which handles system command execution. In environments configured to allow built-in modules, an attacker capable of running untrusted code within the sandbox can load this module to break containment. This can result in arbitrary code execution on the underlying host system.
Statement
This vulnerability is rated Critical because an unauthenticated or untrusted actor able to evaluate script logic within the sandbox can escape isolation without privileges and execute arbitrary commands on the host system. This escape results in complete loss of confidentiality, integrity, and availability for the hosting environment. In Red Hat environments, including Red Hat Developer Hub and Ansible Automation Platform, backend services utilizing the vulnerable library for dynamic code evaluation risk full host container compromise.
Mitigation
Until the fix is applied, do not configure NodeVM with require.builtin set to ['*'], a star-minus subtract list, or an explicit child_process allow. Use a tight builtin allowlist that excludes child_process.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9.8 | N/A | 10 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
RH vm2 sandbox-escape scoring: Scope Unchanged (host Node process is the same security authority). Matches CVE-2023-29017. CNA used S:C (10.0).
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
