CVE-2026-93604

vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM (require.builtin: ['crypto']). The builtin sanitizer (sanitizeCryptoModule in lib/builtin.js) replaces crypto.setEngine but leaves crypto.setFips callable, and the readonly wrapper used to expose the host module does not localize side effects of forwarded host functions. Guest code can therefore call crypto.setFips() to change the FIPS mode of the entire host process; the modified mode is subsequently observed by trusted host code (crypto.getFips() changed from 0 to 1 in the reported test), crossing the NodeVM isolation boundary. Fixed in vm2 3.12.1.

• CWE-284

• https://github.com/patriksimek/vm2/security/advisories/GHSA-x3v6-43hc-82mc
• https://www.vulncheck.com/advisories/vm2-3.11.8-sandbox-escape-via-crypto-setfips
• https://github.com/patriksimek/vm2/security/advisories/GHSA-x3v6-43hc-82mc

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93599rustls-webpki through 0.103.12 (and 0.104.0-alpha releases b…7.5
• CVE-2026-9360A security flaw has been discovered in Edimax EW-7438RPn 1.2…8.8
• CVE-2026-93600rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103…2.2
• CVE-2026-93601rustls-webpki (the Rust webpki fork used by rustls) versions…2.2
• CVE-2026-93602rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 c…4.4
• CVE-2026-93603vm2 through 3.12.0 (fixed in 3.12.1) does not correctly hand…10
• CVE-2026-93605vm2 NodeVM versions before 3.12.1 contain a sandbox escape v…10
• CVE-2026-93606vm2 (npm) versions 3.12.0 and earlier contain a sandbox esca…10
• CVE-2026-9361A weakness has been identified in Edimax EW-7438RPn 1.12. Th…6.3
• CVE-2026-9362A security vulnerability has been detected in Edimax EW-7438…6.3
• CVE-2026-9363A vulnerability was detected in Edimax EW-7438RPn 1.12. This…6.3
• CVE-2026-9364A flaw has been found in projectworlds Online Art Gallery Sh…7.3