What happened
A cluster of CVSS 9.0-10.0 vulnerabilities disclosed Sept 17, 2026 shows vm2's builtin-module proxy fails to properly isolate shared host singletons (https.globalAgent, tls, crypto) from sandboxed code, and separate flaws allow full sandbox escape via CLI tooling and __proto__ access.
Why it matters
vm2 is a commonly-embedded sandbox for running untrusted or LLM-generated JavaScript inside AI coding agents and code-execution MCP tools; a credential-leaking or fully-escaping sandbox undermines the core isolation guarantee that agent frameworks rely on to safely execute model-generated code.
Attack vector
When a NodeVM sandbox is configured to allow require('https') or other builtins, sandboxed (attacker/LLM-generated) code can reach the real host process-global objects (https.globalAgent, tls, crypto modules) through an insufficiently isolated read-only proxy, allowing sandboxed code to capture Authorization/Cookie/API-key headers and plaintext TLS responses from host requests, or fully escape the sandbox to host code execution.
Affected systems
vm2 (npm) versions 3.9.6 through 3.11.7 (multiple related CVEs: 92940, 92939, 92941, 92942, 92949, 92950, 92951, 92954, 92955)
Mitigation
Upgrade to vm2 patched releases per GHSA-h85j-hv3c-qfgq and related advisories; audit any AI agent/code-exec tool that grants NodeVM sandboxes access to network builtins; consider migrating to actively maintained isolation technology (vm2 is effectively unmaintained upstream).