CVE-2026-92939

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call crypto.setEngine() with a filesystem path to an attacker-supplied native library (for example, one bundled in an untrusted plugin package already written to disk); OpenSSL asks the operating-system dynamic loader to load the file, and the library's constructor executes native code in the host process before engine-symbol validation rejects it. Exploitation requires only the crypto builtin and does not require fs, process, module, child_process, worker_threads, vm, or inspector access, resulting in a sandbox escape and arbitrary native code execution. Fixed in 3.11.7.

• CWE-114

• https://github.com/patriksimek/vm2/security/advisories/GHSA-46pr-c5wc-xffx
• https://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-native-code-execution-via-crypto-setengine
• https://github.com/patriksimek/vm2/security/advisories/GHSA-46pr-c5wc-xffx

Published

Sep 17, 2026

Last Modified

Sep 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92933vm2 is a sandbox for running untrusted Node.js code. In vers…5.8
• CVE-2026-92934vm2 before 3.11.8 contains an incomplete fix for Error.cause…9
• CVE-2026-92935vm2 is a sandbox for running untrusted Node.js code. In vers…9
• CVE-2026-92936vm2 versions 3.11.0 through 3.11.6 leak absolute host filesy…5.8
• CVE-2026-92937vm2 3.11.6 is vulnerable to a sandbox escape leading to remo…10
• CVE-2026-92938vm2 versions 3.11.3 through 3.11.6 expose Node.js's host nod…9.9
• CVE-2026-9294A vulnerability was identified in Edimax BR-6428NS 1.10. The…8.8
• CVE-2026-92940vm2 versions 3.11.3 through 3.11.6 expose the host process's…10
• CVE-2026-92941vm2 versions from 3.11.3 before 3.11.7 expose the host tls m…10
• CVE-2026-92942vm2 before 3.11.7 (affected versions <= 3.11.6) does not enf…7.5
• CVE-2026-92943Improper validation of certificate with host mismatch in the…8.1
• CVE-2026-92944vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape …9.8