Sandbox Escape Vulnerability in vm2 by npm

CVE-2026-92955

What is CVE-2026-92955?

The vm2 package prior to version 3.11.8 contains a critical flaw that enables a sandbox escape via the NodeVM component. This vulnerability allows an attacker to manipulate the host proto getters and setters using console._stdout and console._stderr. As a consequence, attackers can potentially overwrite EventEmitter.prototype.emit, allowing unauthorized execution of code within the process context. This breach effectively circumvents existing code generation restrictions, posing significant security risks.

References