CVE-2026-92949

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. An attacker can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to extract and invoke host o...