# CVE-2026-93603

vm2 sandbox escape → host RCE via non-strict host functions (fixed in 3.12.1).

- Page: https://www.vulneraibility.com/cve/CVE-2026-93603
- CVSS: 10.0
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.73% (percentile 54.2)
- CISA SSVC: exploitation poc, automatable yes, technical impact total (assessed 2026-09-22)
- Weakness: CWE-94
- Also known as: GHSA-j89j-5m6r-cr2q
- Published: 2026-09-18

## Affected versions

- patriksimek vm2: affected < 3.12.1; fixed in 3.12.1

A version outside these ranges is not a statement that it is unaffected.

## Impact

Sandbox escape to host: attacker can obtain host global, access process, load child_process and execute arbitrary commands (RCE).

## Action

Immediate action required

## Recommendation

Upgrade vm2 to >= 3.12.1 and audit/remove non-strict host functions exposed to sandboxes.

## References

- [advisory] https://github.com/patriksimek/vm2/security/advisories/GHSA-j89j-5m6r-cr2q
- [advisory] https://www.vulncheck.com/advisories/vm2-before-3.12.1-sandbox-escape-rce-via-non-strict-host-function

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.