vm2 CVE-2026-92955

Requires the target application to instantiate a vm2 NodeVM and execute attacker-controlled JavaScript inside it - vm2's core purpose, so within any app that uses vm2 for untrusted code there is no additional barrier. There is no standalone network service; the AV:N reflects that untrusted JavaScript typically arrives over the network to such evaluators. Exploitation is limited to applications still running the deprecated vm2 library at a version before the stated 3.11.8 fix; products not using vm2, or using it only for trusted code, are not affected. No authentication or user interaction beyond getting code into the sandbox is required (PR:N/UI:N per the vendor vector).

This is a genuine maximum-severity issue within its threat model: a NodeVM sandbox escape yielding full host code execution. The vendor CVSS 4.0 is 10.0 (AV:N/AC:L/PR:N/UI:N with all vulnerable- and subsequent-system impacts High), and CWE-913 (improper control of dynamically-managed code resources) fits a prototype-chain reach that overwrites EventEmitter.prototype.emit to run in host process context. However, the raw 10.0 is conditioned on the vm2 threat model: the score is only meaningful for applications that deliberately run attacker-controlled JavaScript inside vm2 NodeVM. There is NO EPSS score, NO CISA KEV listing, and POC status is not confirmed in the input (a proof-of-concept is likely present in the GHSA-88hf-g992-jg85 advisory but this is not stated), so exploitation is 'no public exploit identified at time of analysis'. Net: for any product still using deprecated vm2 (<3.11.8) to sandbox untrusted code, this is a top-priority patch/replace item because escape = total host compromise; for everyone else it is not exploitable. The all-High 4.0 vector with SC/SI/SA:H is defensible here since the escape crosses the sandbox security boundary into the host process, which is a true scope change. One caveat: fix version 3.11.8 does not match vm2's real public history (development ceased around 3.9.19 and the library was deprecated in 2023), so the version metadata should be treated with caution and verified against the vendor advisory.

An application uses vm2 NodeVM to execute untrusted user-supplied JavaScript (e.g. a plugin runner, online code evaluator, or serverless-style function host). Attacker-submitted sandbox code walks from console._stdout/console._stderr to the host __proto__ getter/setter, overwrites EventEmitter.prototype.emit, and triggers a process event to execute code in the host process, escaping the sandbox and gaining full host access. POC availability is not confirmed in the provided data, though advisories for this vm2 wave commonly include one.