CVE-2026-92960

vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: '' configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers to hijack the host process DNS resolver globally, redirecting all subsequent host DN...