CVE-2026-92950

Katalog CVE

CVSS 8.6 · High EPSS 0,20%

Kerentanan Insecure Default Variable Initialization. Skor CVSS 3.1 8.6 (High) menurut vulncheck.com.

Deskripsi (NVD)

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.

Rincian

Terbit di NVD

17 September 2026

Terakhir diubah

17 September 2026

Status NVD

Deferred

CVSS 3.1

8.6 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-453: Insecure Default Variable Initialization

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 8,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require