CVE-2026-92955 Details
Description
vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.
A sandbox escape vulnerability has been identified in vm2 versions prior to 3.11.8, specifically within the NodeVM component. This vulnerability allows attackers to access the host's prototype getter and setter through the console's stdout and stderr. By exploiting this access, attackers can overwrite the emit method of the EventEmitter prototype and trigger process events, executing code in the context of the process and bypassing existing restrictions on code generation.
Users are advised to update vm2 to version 3.11.8 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/patriksimek/vm2/security/advisories/GHSA-88hf-g992-jg85 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-88hf-g992-jg85 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/vm2-before-3.11.8-sandbox-escape-via-nodevm | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-913 | Improper Control of Dynamically-Managed Code Resources | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vm2 | <= 3.11.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |