CVE-2026-92949— vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor
Quick assessment
Affected
patriksimek vm2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
vm2 版本 3.9.6 至 3.11.7 之前的版本未能正确限制对冻结对象上访问器属性（accessor properties）的访问，导致沙箱中的脚本可以绕过 和 提供的保护机制。攻击者可以利用 或 方法提取并直接调用宿主对象的 setter，从而修改嵌入方明确标记为只读的属性。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| patriksimek | vm2 | 3.9.6< 3.11.7 |
affected |
3.11.7 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92949
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor
Source: CVE Program / CVE List V5
Vulnerability Description
vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to extract and invoke host object setters directly, mutating properties the embedder explicitly marked read-only.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对假设不可变数据的修改(MAID)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| patriksimek | vm2 | 3.9.6 ~ 3.11.7 | - |
|
II. Public POCs for CVE-2026-92949
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92949
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-92949 (2)
Same Patch Batch · patriksimek · 2026-09-17 · 30 CVEs total
| CVE-2026-92947 | 10.0 CRITICAL | vm2 before 3.11.7 Memory Disclosure via Buffer Pool |
| CVE-2026-92941 | 10.0 CRITICAL | vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation |
| CVE-2026-92946 | 10.0 CRITICAL | vm2 before 3.11.7 Remote Code Execution via require.external |
| CVE-2026-92960 | 10.0 CRITICAL | vm2 before 3.11.6 Process-wide State Exposure via os and dns |
| CVE-2026-92940 | 10.0 CRITICAL | vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent |
| CVE-2026-92937 | 10.0 CRITICAL | vm2 3.11.6 Remote Code Execution via Promise call/apply |
| CVE-2026-92955 | 10.0 CRITICAL | vm2 before 3.11.8 Sandbox Escape via NodeVM |
| CVE-2026-92953 | 10.0 CRITICAL | vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray |
| CVE-2026-92956 | 10.0 CRITICAL | vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming |
| CVE-2026-92957 | 9.9 CRITICAL | vm2 before 3.11.7 Authentication Bypass via node: Prefix |
| CVE-2026-92939 | 9.9 CRITICAL | vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine |
| CVE-2026-92938 | 9.9 CRITICAL | vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite |
| CVE-2026-92951 | 9.9 CRITICAL | vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver |
| CVE-2026-92948 | 9.9 CRITICAL | vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test |
| CVE-2026-92944 | 9.8 CRITICAL | vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector |
| CVE-2026-92935 | 9.0 CRITICAL | vm2 NodeVM Remote Code Execution via Array-Shaped Require |
| CVE-2026-92934 | 9.0 CRITICAL | vm2 before 3.11.8 Sandbox Escape RCE via AggregateError |
| CVE-2026-92954 | 8.6 HIGH | vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise |
| CVE-2026-92950 | 8.6 HIGH | vm2 before 3.11.7 Sandbox Escape via CLI require |
| CVE-2026-92958 | 8.5 HIGH | vm2 before 3.11.7 Denylist Bypass via fs/promises |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: vm2
-
CVE-2026-93606
vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species -
CVE-2026-93605
vm2 NodeVM before 3.12.1 Remote Code Execution via child_pro -
CVE-2026-93604
vm2 3.11.8 Sandbox Escape via crypto.setFips -
CVE-2026-93603
vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Fun -
CVE-2026-92963
vm2 before 3.11.2 Information Disclosure via Internal State
Same vendor: patriksimek
-
CVE-2026-93606
vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species -
CVE-2026-93605
vm2 NodeVM before 3.12.1 Remote Code Execution via child_pro -
CVE-2026-93604
vm2 3.11.8 Sandbox Escape via crypto.setFips -
CVE-2026-93603
vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Fun -
CVE-2026-92963
vm2 before 3.11.2 Information Disclosure via Internal State
Same weakness: CWE-471
-
CVE-2026-50481
Azure Active Directory Elevation of Privilege Vulnerability -
CVE-2026-44798
Nautobot: GitRepository.current_head field should not be wri -
CVE-2026-8492
Translate Drupal with GTranslate - Less critical - DOM clobb -
CVE-2025-33136
IBM Aspera Faspex data modification -
CVE-2024-9876
Application is vulnerable to Privilege escalation
V. Comments for CVE-2026-92949
No comments yet