{"vulnerability": "GHSA-46pr-c5wc-xffx", "sightings": [{"uuid": "1fecbc6f-1176-4785-8268-13ecbd3c05da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-46pr-c5wc-xffx", "type": "seen", "source": "https://gist.github.com/alon710/94e3628e7d90125be88b23ee9581fe7e", "content": "# CVE-2026-92939: CVE-2026-92939: Critical Sandbox Escape via Host Crypto setEngine Native Code Execution in vm2\n\n> **CVSS Score:** 9.9\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-92939\n\n## Summary\nA critical sandbox escape vulnerability in the vm2 library allows sandboxed JavaScript code to bypass containment and execute arbitrary native code on the host process. This occurs when the host's builtin crypto module is exposed to the NodeVM environment. Although vm2 implements a read-only proxy layer to restrict direct modifications to host properties, it does not prevent invocation of host-level functions. By calling the crypto.setEngine API with a path to a malicious native library on disk, an attacker can trigger OpenSSL's dynamic module loader. The host's operating system loader immediately runs the dynamic library's initializers/constructors before verifying engine compatibility, leading to remote code execution in the context of the host process.\n\n## TL;DR\nThe vm2 sandbox allows unauthenticated execution of arbitrary native code via the crypto.setEngine API when the crypto builtin is permitted, resulting in a full host escape.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-114 (Process Control)\n- **Attack Vector**: Network\n- **CVSS v3.1**: 9.9 (Critical)\n- **EPSS Score**: 0.00616\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing vm2 version 3.11.3 through 3.11.6 with 'crypto' builtin enabled\n- **vm2**: >= 3.11.3, <= 3.11.6 (Fixed in: `3.11.7`)\n\n## Mitigation\n\n- Upgrade vm2 to version 3.11.7 or higher\n- Disable 'crypto' module in NodeVM configurations if not strictly required\n- Migrate to isolation solutions such as microVMs, WebAssembly, or ephemeral containers\n\n**Remediation Steps:**\n1. Audit existing codebase for instances of NodeVM initialization.\n2. Ensure the 'require.builtin' configuration array does not contain 'crypto'.\n3. Update package.json dependencies to reference 'vm2': '^3.11.7'.\n4. Rebuild and redeploy application containers or execution environments.\n\n## References\n\n- [NVD - CVE-2026-92939 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-92939)\n- [GitHub Security Advisory GHSA-46pr-c5wc-xffx](https://github.com/patriksimek/vm2/security/advisories/GHSA-46pr-c5wc-xffx)\n- [VulnCheck Advisory for CVE-2026-92939](https://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-native-code-execution-via-crypto-setengine)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-92939) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-02T09:30:30.000000Z"}]}