cyfenced.com →

[ CVE-2026-92955 · Published 17 Sep 2026 ]

vm2: Sandbox Escape (NodeVM)

CVSS 10.0 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)
  • Critical severity: CVSS 10.0

[ Description ]Official description

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.

[ Fixes ]Fixes and patches

  • vm2 3.11.8Fixed version · GitHub Advisories · npm package vm2: upgrade to 3.11.8 or later (affected <= 3.11.7)

[ Packages ]Affected open-source packages

[ References ]References