CVE-2026-92949

CVE-2026-92949 · vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor

This page contains facts from public vulnerability sources. Check the original advisory before updating.

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to extract and invoke host object setters directly, mutating properties the embedder explicitly marked read-only.

CVSS 6.3 · Medium · EPSS 0.3% · Public exploit · Fix available

Published

2026-09-17T13:46:09.471Z

Updated

2026-09-21T17:14:33.106Z

Stack: node

Check your server →