Topic

GHSA-qhwx-74w5-xhxq

1 articleUpdated 2 Oct 2026

$3D conceptual cybernetic illustration of fracturing Node.js core with unauthorized child processes and execArgv command strings escaping into host memory$
ThreatsCloud & SaaSBreaking
vm2 NodeVM Allowlist Bypass via node:test Runner execArgv Grants Arbitrary Host Process Execution (CVE-2026-92948)
A critical sandbox escape in vm2 allows sandboxed scripts in Node.js 24+ to reach the node:test runner and invoke run() with arbitrary execArgv CLI flags.
CST Newsroom2 Oct 20269 min read