CVE-2026-92952

A flaw was found in vm2. The vm2 sandbox incompletely filters Node.js internal symbols, specifically nodejs.stream.disturbed and nodejs.stream.errored, across the sandbox boundary. This allows code running within the sandbox to obtain real host symbols and use them to corrupt the host-visible...

EUVD-2026-81601

vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known dangerous registered symbols that omi...

CVE-2026-92952 vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass

vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known dangerous registered symbols that omi...