CVE-2026-93603 — Patriksimek
CRITICALCVE-2026-93603 is a critical-severity (CVSS 10) Code Injection vulnerability. No vendor fix is recorded yet; mitigation options are listed below.
vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code calls a host-provided non-strict…
Description
vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish this receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code calls a host-provided non-strict (sloppy-mode) function without a receiver — e.g. fn(), a detached method, fn.call(), fn.apply(undefined), Reflect.apply(fn, undefined, []), or fn.bind()() — the undefined receiver is passed straight through to the host call, and V8 substitutes the host realm's global object for this. vm2 then wraps and returns that object to the sandbox, giving sandboxed script a live proxy of the host global. This allows a complete sandbox escape: untrusted script can reach process and execute arbitrary code/commands on the host (for example via process.getBuiltinModule('child_process').execSync). Exploitation requires that the embedding application expose at least one non-strict host function to the sandbox; strict-mode and ES module host functions are not affected.
Detection & mitigation playbook
VulnerabilityDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for the affected component, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
No patched version of the affected component has shipped for CVE-2026-93603 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2026-93603 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2026-93603. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-93603 in your dependencies?
O3 Security finds CVE-2026-93603 across dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.