Sandbox Symbol Filtering Bypass in vm2 Affected by Node.js Internal Symbols

CVE-2026-92952

What is CVE-2026-92952?

The vm2 versions 3.11.4 to 3.11.6 contain a vulnerability that allows bypassing sandbox security measures by failing to completely filter Node.js registered internal symbols. Specifically, the filters for managing access between the sandbox and host environment inadvertently expose certain dangerous internal symbols from the host WebStream prototypes in newer Node.js versions. This oversight enables sandboxed code to retrieve and manipulate the actual host stream state, jeopardizing the integrity of stream state checks and potentially leading to incorrect responses in critical operations. Users are advised to upgrade to vm2 version 3.11.7, which addresses this issue.

References