Critical Sandbox Escape Vulnerability in vm2 Library Disclosed

A critical sandbox escape (CVE-2026-92948) in the vm2 library (versions 3.9.6–3.11.6) on Node.js 24+ allows attackers to bypass module blocking via double-prefixing restricted module names, import the node:test module, and execute arbitrary shell commands outside the VM. The vulnerability has a CVSS score of 9.4, was published on 2026-09-17, and is patched in vm2 version 3.11.7; users are urged to upgrade and apply mitigations to protect systems running untrusted code.