Skip to content
fr Sign in
6.3 Medium

CVE-2026-92949 vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects,…

Description

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to extract and invoke host object setters directly, mutating properties the embedder explicitly marked read-only.

Affected products and versions

Product Affected versions Fixed in
vm2 3.11 earliest → < 3.11.7 3.11.7
vm2 3.9 3.9.6 → < 3.11.7 3.11.7

References

Timeline

  1. Published
  2. Last modified

Other CVEs of vm2

The 77 CVEs of vm2 →
CVE-2026-100723 vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength… 6.9 Medium CVE-2026-100722 vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap 8.9 High CVE-2026-100721 vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver 9.5 Critical CVE-2026-93606 vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM` 10.0 Critical
Track this CVE