CVE-2026-92949
Medium · 4.0CVSS
4.0
EPSS
0.3%
Published
Sep 17, 2026
CISA due date
—
The record
vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to extract and invoke host object setters directly, mutating properties the embedder explicitly marked read-only.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-103001 PyJWT is a Python implementation of JSON Web Token standards. CWE-471
- CVE-2026-84664 Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection… CWE-471
- CVE-2026-59299 Composition lookup can potentially poison base function in Spring Cloud Function. CWE-471
- CVE-2026-54267 Angular is a development platform for building mobile and desktop web applications using… CWE-471
- GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook… CWE-471
- GHSA-rgjc-h3x7-9mwg Angular Client Hydration DOM Clobbering & Response-Cache Poisoning CWE-471
- CVE-2026-44798 Nautobot is a Network Source of Truth and Network Automation Platform. CWE-471
- CVE-2026-8492 Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal… CWE-471