CVE-2026-92949: vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor
vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or lookupSetter() to extract and invoke host object setters directly, mutating properties the embedder explicitly marked read-only.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.7 - Compensating control
Ensure sandboxed code cannot reach or mutate host object properties by reviewing and hardening any host-object APIs exposed to vm2, since accessor descriptor methods like Object.getOwnPropertyDescriptor() and __lookupSetter__ can be used to extract and invoke setters that were intended to be read-only.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using npm/vm2 versions from 3.9.6 before 3.11.7 are exposed when they run untrusted or attacker-controlled scripts in a vm2 sandbox and provide those scripts access to frozen or read-only host objects with accessor properties.
What does an attacker need to exploit it?
An attacker needs the ability to execute a script inside the affected vm2 sandbox. The script can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to obtain and directly invoke a host object's setter.
What is the security impact?
The attacker can mutate properties that the embedder explicitly attempted to protect with vm.freeze() or vm.readonly(). The provided vector indicates integrity impact without confidentiality or availability impact.
How can I determine whether my application is affected?
Check whether your application uses npm/vm2 in the affected version range and exposes host objects to sandboxed code through vm.freeze() or vm.readonly(). Review those objects for accessor properties, particularly setters, that sandboxed scripts could inspect.