CVE-2026-92939 Details
Description
vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call crypto.setEngine() with a filesystem path to an attacker-supplied native library (for example, one bundled in an untrusted plugin package already written to disk); OpenSSL asks the operating-system dynamic loader to load the file, and the library's constructor executes native code in the host process before engine-symbol validation rejects it. Exploitation requires only the crypto builtin and does not require fs, process, module, child_process, worker_threads, vm, or inspector access, resulting in a sandbox escape and arbitrary native code execution. Fixed in 3.11.7.
A vulnerability exists in the vm2 library versions 3.11.3 through 3.11.6, where the host Node.js crypto module is exposed to a NodeVM sandbox. This occurs when the crypto builtin is allowed. Although the module is presented through a recursive read-only proxy, its callable exports execute with host-process authority. This allows sandboxed JavaScript to invoke crypto.setEngine() with a path to an attacker-supplied native library, such as one included in an untrusted plugin package that has already been written to disk. OpenSSL then uses the operating system's dynamic loader to load the library, executing its constructor in the host process before validating the engine's usability. As a result, arbitrary native code can be executed in the host process, leading to a sandbox escape. The vulnerability does not require access to filesystem, process, module, child_process, worker_threads, vm, inspector, or unrestricted builtins, and has been patched in version 3.11.7.
Users can upgrade to vm2 version 3.11.7 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/patriksimek/vm2/security/advisories/GHSA-46pr-c5wc-xffx | CISA-ADP | AdvisoryExploitRemedyTechnical DescriptionVendor |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-46pr-c5wc-xffx | [email protected] | AdvisoryExploitRemedyTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-native-code-execution-via-crypto-setengine | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-114 | Process Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vm2 | >= 3.11.3, <= 3.11.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |