{"vulnerability": "CVE-2026-92956", "sightings": [{"uuid": "5775dfa3-c013-41b2-a1b5-1c53ad145ed8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92956", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvq253bvtj2j", "content": "\ud83d\udea8 CVE-2026-92956 \u2014 CVSS 10 CRITICAL\n\nvm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox whe...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92956\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:10:35.411576Z"}, {"uuid": "4ec44329-7fed-44e9-a5ae-cd607b237348", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92956", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvq4dt2b7b2t", "content": "CVE-2026-92956 - vm2\nVersions 3.10.1 through 3.11.6 of the vm2 library let code run inside its default sandbox reach the underlying Node.js environment. An attacker could obtain the real process object and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T16:50:10.288085Z"}, {"uuid": "2744c0e3-1c72-4382-a8bd-351a08cf1ce8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92956", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117287817060203283", "content": "ICYMI: 19 sev:CRIT CVEs in Node VM2, which is supposed to be a sandbox, but apparently it's built like the AI \"sandboxes.\"\nhttps://www.cve.org/CVERecord?id=CVE-2026-92934https://www.cve.org/CVERecord?id=CVE-2026-92935https://www.cve.org/CVERecord?id=CVE-2026-92937https://www.cve.org/CVERecord?id=CVE-2026-92938https://www.cve.org/CVERecord?id=CVE-2026-92939https://www.cve.org/CVERecord?id=CVE-2026-92940https://www.cve.org/CVERecord?id=CVE-2026-92941https://www.cve.org/CVERecord?id=CVE-2026-92944https://www.cve.org/CVERecord?id=CVE-2026-92946https://www.cve.org/CVERecord?id=CVE-2026-92947https://www.cve.org/CVERecord?id=CVE-2026-92948https://www.cve.org/CVERecord?id=CVE-2026-92950https://www.cve.org/CVERecord?id=CVE-2026-92951https://www.cve.org/CVERecord?id=CVE-2026-92953https://www.cve.org/CVERecord?id=CVE-2026-92954https://www.cve.org/CVERecord?id=CVE-2026-92955https://www.cve.org/CVERecord?id=CVE-2026-92956https://www.cve.org/CVERecord?id=CVE-2026-92957https://www.cve.org/CVERecord?id=CVE-2026-92960", "creation_timestamp": "2026-09-17T18:34:22.144297Z"}]}