EUVD-2026-81601

vm2: Incomplete nodejs. symbol filtering lets sandbox override host WebStream state checks...

CVE-2026-92952

A flaw was found in vm2. The vm2 sandbox incompletely filters Node.js internal symbols, specifically nodejs.stream.disturbed and nodejs.stream.errored, across the sandbox boundary. This allows code running within the sandbox to obtain real host symbols and use them to corrupt the host-visible...

CVE-2026-92952

vm2 (Node.js sandboxing library) versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The fixed symbol lists in lib/setup-sandbox.js and lib/bridge.js omit nodejs.stream.disturbed and nodejs.stream.errored , exposed on host WebStream ...

PT-2026-94323

Name of the Vulnerable Software and Affected Versions vm2 versions 3.11.4 through 3.11.6 Description Internal Node.js registered symbols are incompletely filtered across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in...