Sandbox Bypass in vm2 Affected by Improper Access Control

CVE-2026-92949

What is CVE-2026-92949?

The vm2 library, specifically versions from 3.9.6 to 3.11.6, is susceptible to a vulnerability that fails to properly restrict access to accessor properties on frozen objects. This flaw permits sandboxed scripts to circumvent crucial protections established by vm.freeze() and vm.readonly(). By exploiting Object.getOwnPropertyDescriptor() or lookupSetter(), attackers are able to directly manipulate host object setters, overriding properties that were intended to be read-only by the embedding application. This could lead to unauthorized modifications and potential security breaches.

References