CVE-2026-92960— vm2 before 3.11.6 Process-wide State Exposure via os and dns
Quick assessment
Affected
patriksimek vm2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 vm2 3.11.6 之前，当配置为 时，未能有效限制对 和 内置模块的访问权限，使得沙箱中的代码能够读取宿主进程的身份信息和网络拓扑结构。攻击者可以调用 方法，从而全局劫持宿主进程的 DNS 解析器，将所有后续的宿主 DNS 查询重定向到由攻击者控制的解析器。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92960
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
vm2 before 3.11.6 Process-wide State Exposure via os and dns
Source: CVE Program / CVE List V5
Vulnerability Description
vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver globally, redirecting all subsequent host DNS queries through an attacker-controlled resolver.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| patriksimek | vm2 | 0 ~ 3.11.6 | - |
|
II. Public POCs for CVE-2026-92960
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92960
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-92960 (2)
Same Patch Batch · patriksimek · 2026-09-17 · 30 CVEs total
| CVE-2026-92946 | 10.0 CRITICAL | vm2 before 3.11.7 Remote Code Execution via require.external |
| CVE-2026-92947 | 10.0 CRITICAL | vm2 before 3.11.7 Memory Disclosure via Buffer Pool |
| CVE-2026-92941 | 10.0 CRITICAL | vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation |
| CVE-2026-92940 | 10.0 CRITICAL | vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent |
| CVE-2026-92955 | 10.0 CRITICAL | vm2 before 3.11.8 Sandbox Escape via NodeVM |
| CVE-2026-92953 | 10.0 CRITICAL | vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray |
| CVE-2026-92937 | 10.0 CRITICAL | vm2 3.11.6 Remote Code Execution via Promise call/apply |
| CVE-2026-92956 | 10.0 CRITICAL | vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming |
| CVE-2026-92957 | 9.9 CRITICAL | vm2 before 3.11.7 Authentication Bypass via node: Prefix |
| CVE-2026-92939 | 9.9 CRITICAL | vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine |
| CVE-2026-92938 | 9.9 CRITICAL | vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite |
| CVE-2026-92951 | 9.9 CRITICAL | vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver |
| CVE-2026-92948 | 9.9 CRITICAL | vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test |
| CVE-2026-92944 | 9.8 CRITICAL | vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector |
| CVE-2026-92935 | 9.0 CRITICAL | vm2 NodeVM Remote Code Execution via Array-Shaped Require |
| CVE-2026-92934 | 9.0 CRITICAL | vm2 before 3.11.8 Sandbox Escape RCE via AggregateError |
| CVE-2026-92954 | 8.6 HIGH | vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise |
| CVE-2026-92950 | 8.6 HIGH | vm2 before 3.11.7 Sandbox Escape via CLI require |
| CVE-2026-92958 | 8.5 HIGH | vm2 before 3.11.7 Denylist Bypass via fs/promises |
| CVE-2026-92942 | 7.5 HIGH | vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: vm2
-
CVE-2026-92963
vm2 before 3.11.2 Information Disclosure via Internal State -
CVE-2026-92962
vm2 before 3.11.4 Defense Invariant Violation via setup-sand -
CVE-2026-92961
vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit -
CVE-2026-92959
vm2 before 3.11.8 allowAsync Bypass via Promise Thenable -
CVE-2026-92958
vm2 before 3.11.7 Denylist Bypass via fs/promises
Same vendor: patriksimek
-
CVE-2026-92963
vm2 before 3.11.2 Information Disclosure via Internal State -
CVE-2026-92962
vm2 before 3.11.4 Defense Invariant Violation via setup-sand -
CVE-2026-92961
vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit -
CVE-2026-92958
vm2 before 3.11.7 Denylist Bypass via fs/promises -
CVE-2026-92959
vm2 before 3.11.8 allowAsync Bypass via Promise Thenable
Same weakness: CWE-200
-
CVE-2026-85717
AsyncHttpClient: Client-wide realm credentials re-sent to a -
CVE-2026-69197
Umbraco: Delivery API leaks protected (Public Access) conten -
CVE-2026-75523
Steeltoe.Management.Endpoint: HttpExchanges URI masking leak -
CVE-2026-63461
Vendure: Shop API list queries can return non-public entitie -
CVE-2026-80356
Dell OpenManage 11.1.0.3前版本敏感信息泄露漏洞
V. Comments for CVE-2026-92960
No comments yet