vm2 CVE-2026-92952

Requires all of: (1) the vm2 threat model - the application runs untrusted/attacker-controlled JavaScript inside the sandbox; (2) the embedder explicitly exposes a host WebStream object AND the host stream/web module to the sandbox (not a default configuration); (3) a newer Node.js runtime where nodejs.stream.disturbed and nodejs.stream.errored are exposed on WebStream prototypes (validated on Node.js v25.8.0). Limiting factors: elevated attack complexity, dependence on non-default host-object exposure, dependence on a specific Node.js version, and integrity-only impact (no confidentiality/availability loss and no host code execution per the reported proof).

This is a moderate-to-high integrity issue, not a critical one, despite the 8.9 vendor score. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SI:H) is internally consistent with the description: integrity-only impact (VI:H/SI:H) with no confidentiality or availability loss, and elevated attack complexity (AC:H) plus an attack requirement (AT:P) reflecting the need for a specific newer Node.js runtime (validated on v25.8.0) and an embedder that exposes a host WebStream object plus the host stream/web module. The description explicitly states this is NOT a host code-execution primitive in the reported proof of vulnerability, which correctly downgrades it from the RCE-class members of the vm2 escape lineage. Exploitation status: no public exploit identified at time of analysis - there is no KEV listing and no POC signal in the provided data (only a mention of a 'reported proof of vulnerability' in the advisory, which is a demonstration, not weaponized exploit code). EPSS is not provided. The 'Authentication Bypass' tag conflicts with the actual impact - this corrupts host stream-state bookkeeping (e.g., forcing isDisturbed() to return false), it does not bypass authentication; treat that tag as mislabeled. Bottom line: real but conditional priority, gated on both a non-trivial embedder configuration and a modern Node.js version, so realistic exposure is narrower than the raw 8.9 suggests.

An application embeds vm2 (3.11.4-3.11.6) on a newer Node.js release and hands sandboxed untrusted code a host WebStream object plus the host stream/web module. The sandboxed code calls Object.getOwnPropertySymbols on the host ReadableStream prototype to recover the unfiltered nodejs.stream.disturbed / nodejs.stream.errored symbols, then writes them onto host stream objects to falsify state - making an already-consumed stream appear un-consumed and defeating host one-shot body-consumption or errored-stream-rejection logic. A proof of vulnerability was reported in the advisory, but no weaponized public exploit is identified.