CVE-2026-92949

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92949
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92949.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92949
Aliases
  • GHSA-633r-hq9m-c4ff
Published
2026-09-17T13:46:09Z
Modified
2026-09-18T03:48:43Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor
Details

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or lookupSetter() to extract and invoke host object setters directly, mutating properties the embedder explicitly marked read-only.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-471"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92949.json"
}
References

Affected packages

Git / github.com/patriksimek/vm2

Affected ranges

Type
GIT
Repo
https://github.com/patriksimek/vm2
Events
Introduced
532120d5cdec7da8225fc6242e154ebabc63fe4d
Fixed
0c5b63a228c0af88d4a0d364ab0b90df278d710e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.9.6"
        },
        {
            "fixed": "3.11.7"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

3.*
3.11.6
3.9.10
3.9.11
3.9.12
3.9.13
3.9.14
3.9.15
3.9.16
3.9.17
3.9.18
3.9.19
3.9.6
3.9.7
3.9.8
3.9.9
v3.*
v3.10.0
v3.10.1
v3.10.2
v3.10.3
v3.10.4
v3.10.5
v3.11.0
v3.11.1
v3.11.2
v3.11.3
v3.11.4
v3.11.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92949.json"