CVE-2026-92949
Last modified
CVE-2026-92949 is a medium-severity vulnerability rated 4/10 on the CVSS scale. vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to extract and invoke host object setters directly, mutating properties the embedder explicitly marked read-only..
Description
vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to extract and invoke host object setters directly, mutating properties the embedder explicitly marked read-only.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-92949?
How severe is CVE-2026-92949?
How do I fix CVE-2026-92949?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92943Improper validation of certificate with host mismatch in the…8.1
- CVE-2026-92944vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape …9.8
- CVE-2026-92945vm2 before 3.11.7 contains a module allowlist bypass vulnera…4.2
- CVE-2026-92946vm2 before 3.11.7 contains a remote code execution vulnerabi…10
- CVE-2026-92947vm2 before 3.11.7 exposes Node's shared Buffer pool to sandb…10
- CVE-2026-92948vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM…9.9
- CVE-2026-9295A security flaw has been discovered in Edimax BR-6428NS 1.10…8.8
- CVE-2026-92950vm2 before 3.11.7 contains a sandbox escape vulnerability in…8.6
- CVE-2026-92951vm2 before 3.11.7 contains an incorrect authorization vulner…9.9
- CVE-2026-92952vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.…6.8
- CVE-2026-92953vm2 versions from 3.11.0 before 3.11.8 fail to protect host …10
- CVE-2026-92954vm2 is a sandbox library for running untrusted JavaScript in…8.6
Are you affected by CVE-2026-92949?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST