Topic
2 articles
CyberSecureToday covers vm2 across 2 articles published between 1 Oct 2026 and 2 Oct 2026.
The coverage includes 2 vulnerability advisories. 2 advisories are rated critical or high severity.
Stories on vm2 most often intersect with Node.js, Sandbox Escape and Remote Code Execution, with Technology, Cloud & SaaS the most affected sector. The most recent story, “vm2 NodeVM Allowlist Bypass via node:test Runner execArgv Grants Arbitrary Host Process Execution (CVE-2026-92948)”, was published 2 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.
Threat IntelA critical sandbox escape in vm2 allows sandboxed scripts in Node.js 24+ to reach the node:test runner and invoke run() with arbitrary execArgv CLI flags.
Crypto / Web3A critical sandbox escape in vm2 allows untrusted NodeVM scripts to invoke OpenSSL engine loading via crypto.setEngine, executing arbitrary native code on the host.