CVE-2026-92939

A flaw was found in vm2. When the cryptographic built-in module is enabled, functions exposed to the sandbox continue to run with the privileges of the host process. An attacker capable of running untrusted code within the sandbox can invoke the crypto.setEngine function to load a malicious local...