HTTPS Credential Exposure in vm2 by Patrik Simek

CVE-2026-92940

What is CVE-2026-92940?

The vulnerability affects vm2 versions 3.11.3 through 3.11.6, where the real host process's https.globalAgent is exposed to sandboxed code. This occurs when a NodeVM is configured to allow the use of 'https'. While the built-in loader wraps host modules in a read-only proxy, certain method calls can directly interact with the underlying host object. This allows sandboxed code to register listeners for the agent's events, leading to unauthorized access to the host's authorization headers and connection details. Attackers can exploit this exposure to conduct unauthorized requests with stolen credentials. Users should upgrade to vm2 version 3.11.7 or later to mitigate this risk.

References