EUVD-2026-81589

vm2 crypto builtin loads attacker native code through setEngine...

CVE-2026-92939

A flaw was found in vm2. When the cryptographic built-in module is enabled, functions exposed to the sandbox continue to run with the privileges of the host process. An attacker capable of running untrusted code within the sandbox can invoke the crypto.setEngine function to load a malicious local...

The vulnerability of the crypto.setEngine() function in the vm2 package manager NPM allows a hacker to execute arbitrary code.

The vulnerability of the crypto.setEngine function in the vm2 package manager’s NPM library is related to improper management of processes. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Process Control

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Process Control in the crypto.setEngine function. An attacker can execute arbitrary native code in the host process by supplying a path to a maliciou...

CVE-2026-92939

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call...

CVE-2026-92939

CVE-2026-92939 affects the vm2 Node.js sandboxing library (versions 3.11.3 through 3.11.6 ). When the crypto builtin is permitted, the host Node.js crypto module is exposed to the sandbox via a recursive read-only proxy, but its callable exports still execute with host-process authority . Sandbox...

CVE-2026-92939 vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call...

CVE-2026-92939 vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call...

CVE-2026-92939 vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call...

PT-2026-105489

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-46pr-c5wc-xffx. This link is maintained to preserve external references. Original Description vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is...

ROS-20240916-12

Vulnerability in the crypto.setEngine method of the Node.js software platform is related to flaws in access delimitation access. Exploitation of the vulnerability could allow an attacker acting remotely to bypass the existing security restrictions...

BIT-NODE-2023-30586

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine API can be used to bypass...

Privilege escalation vulnerability in Node.js 20 could allow loading arbitrary OpenSSL engines when the experimental permission model is enabled (CVE-2023-30586).

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine API can be used to bypass...

CVE-2023-30586

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine API can be used to bypass...

CVE-2023-30586

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine API can be used to bypass...

CVE-2023-30586

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine API can be used to bypass...

CVE-2023-30586: Missing Authorization

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine API can be used to bypass...