Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-92962— vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js

Quick assessment

Affected
patriksimek vm2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是这段漏洞描述的中文翻译： vm2 是一个用于运行不可信 JavaScript 代码的沙箱。在 3.11.3 及更早版本的 vm2 中， 中的 函数使用“原型链遍历”的索引赋值方式（ ）来构建其输出数组，而不是使用能够绕过原型的 原语。由于这个桥接内部的数组是在沙箱域（realm）中分配的，沙箱内部的代码可以为相关索引在 上安装一个访问器（accessor）；每当沙箱读取 （或以其他方式触发 ）时，该访问器就会被调用，从而使沙箱代码能够观察和拦截桥接代码写入的每条堆栈跟踪行。在错误处理（catch）分支中也使用

CVSS 2.1 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92962

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js
Source: CVE Program / CVE List V5
Vulnerability Description
vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js builds its output array using prototype-walking index assignment (lines[lines.length] = value) rather than a prototype-bypassing define-property primitive. Because this bridge-internal array is allocated in the sandbox realm, code inside the sandbox can install an accessor on Array.prototype for the relevant index; the accessor is then invoked whenever the sandbox reads error.stack (or otherwise triggers Error.prepareStackTrace), allowing sandbox code to observe and intercept each stack-trace line written by the bridge. The same pattern is used in the error-handling (catch) branch. The values written are formatted strings only, so the practical impact is limited to an information side channel and a violation of vm2's bridge-container defense invariant rather than a sandbox escape; the vendor rates the issue Low. The issue is fixed in vm2 3.11.4, which installs each entry as an own data property via Reflect.defineProperty.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
patriksimek vm2 0 ~ 3.11.4 -

II. Public POCs for CVE-2026-92962

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92962

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-92962 (2)

Same Patch Batch · patriksimek · 2026-09-17 · 30 CVEs total

CVE-2026-92947 10.0 CRITICAL vm2 before 3.11.7 Memory Disclosure via Buffer Pool
CVE-2026-92941 10.0 CRITICAL vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
CVE-2026-92960 10.0 CRITICAL vm2 before 3.11.6 Process-wide State Exposure via os and dns
CVE-2026-92937 10.0 CRITICAL vm2 3.11.6 Remote Code Execution via Promise call/apply
CVE-2026-92940 10.0 CRITICAL vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent
CVE-2026-92956 10.0 CRITICAL vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
CVE-2026-92953 10.0 CRITICAL vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
CVE-2026-92955 10.0 CRITICAL vm2 before 3.11.8 Sandbox Escape via NodeVM
CVE-2026-92946 10.0 CRITICAL vm2 before 3.11.7 Remote Code Execution via require.external
CVE-2026-92957 9.9 CRITICAL vm2 before 3.11.7 Authentication Bypass via node: Prefix
CVE-2026-92948 9.9 CRITICAL vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test
CVE-2026-92939 9.9 CRITICAL vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine
CVE-2026-92938 9.9 CRITICAL vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite
CVE-2026-92951 9.9 CRITICAL vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
CVE-2026-92944 9.8 CRITICAL vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector
CVE-2026-92935 9.0 CRITICAL vm2 NodeVM Remote Code Execution via Array-Shaped Require
CVE-2026-92934 9.0 CRITICAL vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
CVE-2026-92954 8.6 HIGH vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise
CVE-2026-92950 8.6 HIGH vm2 before 3.11.7 Sandbox Escape via CLI require
CVE-2026-92958 8.5 HIGH vm2 before 3.11.7 Denylist Bypass via fs/promises

Showing top 20 of 30 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: vm2
Same vendor: patriksimek
Same weakness: CWE-693

V. Comments for CVE-2026-92962

No comments yet

Leave a comment