10.0
Critical
CVE-2026-92955 vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__…
Description
vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| vm2 3.11 | earliest → < 3.11.8 | 3.11.8 |
References
- GitHub Security Advisory (GHSA-88hf-g992-jg85) github.com
- VulnCheck Advisory: vm2 before 3.11.8 Sandbox Escape via NodeVM www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of vm2
The 77 CVEs of vm2 →
CVE-2026-100723
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength…
6.9
Medium
CVE-2026-100722
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap
8.9
High
CVE-2026-100721
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver
9.5
Critical
CVE-2026-93606
vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`
10.0
Critical