Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-92952— vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass

Quick assessment

Affected
patriksimek vm2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

vm2 版本 3.11.4 至 3.11.6 对 Node.js 注册内部符号的沙箱边界过滤不彻底。 中的提取过滤器，以及 中的跨域符号检查和写入陷阱，使用了一份固定的已知危险注册符号列表，但该列表遗漏了 和 。这两个符号在较新版本的 Node.js（已在 Node.js v25.8.0 上验证）中会暴露在主机的 WebStream 原型上。 当嵌入端（embedder）将主机的 WebStream 对象和主机 stream/web 模块暴露给沙箱时，沙箱代码可以通过 获取真实的主机符号，并将其用作主机流对象上的写

CVSS 6.8 · Medium EPSS 0.42% · P36

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
patriksimek vm2 3.11.4< 3.11.7 affected
3.11.7 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92952

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known dangerous registered symbols that omits nodejs.stream.disturbed and nodejs.stream.errored, which are exposed on host WebStream prototypes on newer Node.js releases (validated on Node.js v25.8.0). When the embedder exposes a host WebStream object and the host stream/web module to the sandbox, sandbox code can obtain the real host symbols via Object.getOwnPropertySymbols(streamWeb.ReadableStream.prototype) and use them as write keys on host stream objects, corrupting host-visible stream state — for example making stream.Readable.isDisturbed() return false for an already-consumed stream. This can bypass host logic that relies on Node's public stream-state helpers to enforce one-shot body consumption, reject errored streams, or decide whether a stream is safe to hand to another component. It is not a host code-execution primitive in the reported proof of vulnerability. This is an incomplete fix for the earlier nodejs.* symbol filtering issue. Fixed in vm2 3.11.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在范围间的资源转移不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
patriksimek vm2 3.11.4 ~ 3.11.7 -

II. Public POCs for CVE-2026-92952

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92952

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-92952 (2)

Same Patch Batch · patriksimek · 2026-09-17 · 30 CVEs total

CVE-2026-92946 10.0 CRITICAL vm2 before 3.11.7 Remote Code Execution via require.external
CVE-2026-92947 10.0 CRITICAL vm2 before 3.11.7 Memory Disclosure via Buffer Pool
CVE-2026-92941 10.0 CRITICAL vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
CVE-2026-92960 10.0 CRITICAL vm2 before 3.11.6 Process-wide State Exposure via os and dns
CVE-2026-92940 10.0 CRITICAL vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent
CVE-2026-92955 10.0 CRITICAL vm2 before 3.11.8 Sandbox Escape via NodeVM
CVE-2026-92937 10.0 CRITICAL vm2 3.11.6 Remote Code Execution via Promise call/apply
CVE-2026-92953 10.0 CRITICAL vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
CVE-2026-92956 10.0 CRITICAL vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
CVE-2026-92957 9.9 CRITICAL vm2 before 3.11.7 Authentication Bypass via node: Prefix
CVE-2026-92939 9.9 CRITICAL vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine
CVE-2026-92938 9.9 CRITICAL vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite
CVE-2026-92951 9.9 CRITICAL vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
CVE-2026-92948 9.9 CRITICAL vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test
CVE-2026-92944 9.8 CRITICAL vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector
CVE-2026-92935 9.0 CRITICAL vm2 NodeVM Remote Code Execution via Array-Shaped Require
CVE-2026-92934 9.0 CRITICAL vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
CVE-2026-92954 8.6 HIGH vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise
CVE-2026-92950 8.6 HIGH vm2 before 3.11.7 Sandbox Escape via CLI require
CVE-2026-92958 8.5 HIGH vm2 before 3.11.7 Denylist Bypass via fs/promises

Showing top 20 of 30 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: vm2
Same vendor: patriksimek
Same weakness: CWE-669

V. Comments for CVE-2026-92952

No comments yet

Leave a comment