Aller au contenu
en Se connecter
6.3 Moyenne

CVE-2026-92949 vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects,…

Description

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to extract and invoke host object setters directly, mutating properties the embedder explicitly marked read-only.

Produits et versions touchés

Produit Versions touchées Corrigé en
vm2 3.11 premières → < 3.11.7 3.11.7
vm2 3.9 3.9.6 → < 3.11.7 3.11.7

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de vm2

Les 77 CVE de vm2 →
CVE-2026-100723 vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength… 6.9 Moyenne CVE-2026-100722 vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap 8.9 Élevée CVE-2026-100721 vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver 9.5 Critique CVE-2026-93606 vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM` 10.0 Critique
Suivre cette CVE