Vulnerability Description
vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver globally, redirecting all subsequent host DNS queries through an attacker-controlled resolver.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x
- https://www.vulncheck.com/advisories/vm2-before-3.11.6-process-wide-state-exposu
- https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x
FAQ
What is CVE-2026-92960?
CVE-2026-92960 is a vulnerability with a CVSS score of 10.0 (CRITICAL). vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke...
How severe is CVE-2026-92960?
CVE-2026-92960 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-92960?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.