Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-92939— vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine

Quick assessment

Affected
patriksimek vm2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

vm2 3.11.3 至 3.11.6 版本在允许 内置模块时，会将宿主机的 Node.js 模块暴露给 NodeVM 沙箱环境。该模块通过一个递归的只读代理进行暴露，但其可调用的导出函数仍以宿主机进程权限执行。因此，沙箱中的 JavaScript 可以调用 ，并传入攻击者提供的本地库的文件系统路径（例如，已写入磁盘的、打包在不受信任的插件包中的库文件）。OpenSSL 会请求操作系统的动态加载器加载该文件，该库的构造函数会在宿主机进程中执行本地代码，随后引擎符号校验才会将其拒绝。利用此漏洞仅需 内置模块，无需访问

CVSS 9.9 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92939

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine
Source: CVE Program / CVE List V5
Vulnerability Description
vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call crypto.setEngine() with a filesystem path to an attacker-supplied native library (for example, one bundled in an untrusted plugin package already written to disk); OpenSSL asks the operating-system dynamic loader to load the file, and the library's constructor executes native code in the host process before engine-symbol validation rejects it. Exploitation requires only the crypto builtin and does not require fs, process, module, child_process, worker_threads, vm, or inspector access, resulting in a sandbox escape and arbitrary native code execution. Fixed in 3.11.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
流程控制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
patriksimek vm2 3.11.3 ~ 3.11.7 -

II. Public POCs for CVE-2026-92939

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92939

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-92939 (2)

Same Patch Batch · patriksimek · 2026-09-17 · 30 CVEs total

CVE-2026-92946 10.0 CRITICAL vm2 before 3.11.7 Remote Code Execution via require.external
CVE-2026-92947 10.0 CRITICAL vm2 before 3.11.7 Memory Disclosure via Buffer Pool
CVE-2026-92941 10.0 CRITICAL vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
CVE-2026-92960 10.0 CRITICAL vm2 before 3.11.6 Process-wide State Exposure via os and dns
CVE-2026-92940 10.0 CRITICAL vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent
CVE-2026-92955 10.0 CRITICAL vm2 before 3.11.8 Sandbox Escape via NodeVM
CVE-2026-92953 10.0 CRITICAL vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
CVE-2026-92937 10.0 CRITICAL vm2 3.11.6 Remote Code Execution via Promise call/apply
CVE-2026-92956 10.0 CRITICAL vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
CVE-2026-92957 9.9 CRITICAL vm2 before 3.11.7 Authentication Bypass via node: Prefix
CVE-2026-92938 9.9 CRITICAL vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite
CVE-2026-92951 9.9 CRITICAL vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
CVE-2026-92948 9.9 CRITICAL vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test
CVE-2026-92944 9.8 CRITICAL vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector
CVE-2026-92935 9.0 CRITICAL vm2 NodeVM Remote Code Execution via Array-Shaped Require
CVE-2026-92934 9.0 CRITICAL vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
CVE-2026-92954 8.6 HIGH vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise
CVE-2026-92950 8.6 HIGH vm2 before 3.11.7 Sandbox Escape via CLI require
CVE-2026-92958 8.5 HIGH vm2 before 3.11.7 Denylist Bypass via fs/promises
CVE-2026-92942 7.5 HIGH vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry

Showing top 20 of 30 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: vm2
Same vendor: patriksimek
Same weakness: CWE-114

V. Comments for CVE-2026-92939

No comments yet

Leave a comment