CVE-2026-92960: vm2 before 3.11.6 Process-wide State Exposure via os and dns
vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: [''] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver globally, redirecting all subsequent host DNS queries through an attacker-controlled resolver.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.6 - Configuration
In vm2, do not configure access to host builtins with builtin: ['*']; restrict builtin access so sandbox code cannot access os and dns builtins under the builtin setting.
vm2 builtin = not ['*']
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using vm2 before 3.11.6 are exposed when configured with builtin: ['*']. In that configuration, sandboxed code can access the os and dns builtins.
What does an attacker need to exploit this issue?
An attacker needs the ability to execute code inside the vm2 sandbox. No privileges or user interaction are indicated by the supplied vector.
What can an attacker do through the exposed builtins?
Sandbox code can read host process identity and network topology through os and dns. It can also call dns.setServers() to change the host process DNS resolver globally and redirect subsequent host DNS queries to an attacker-controlled resolver.
What should be prioritized if an immediate upgrade is not possible?
Avoid the builtin: ['*'] configuration, since it is the configuration identified as permitting access to os and dns. Prevent untrusted sandbox code from reaching those builtins.