CVE-2026-92941Disclosure

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-732

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-09-19); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets1 URL

By indicator

https://cvebrief.com/

Full discourse2 posts

Ryx@PadhiyarRushi45d
Disclosure
Four vm2 sandbox escapes landed in one disclosure window. CVE-2026-92941 (CVSS 10) plus three more at 9.9. Any service that still runs untrusted JavaScript inside patriksimek/vm2 is exposed to full sandbox escape. High signal if you run Node tooling that evaluates third-party code. https://cvebrief.com/ #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #AppSec #NodeJS
Post summary
The tweet discloses four VM2 sandbox escape CVEs (CVE-2026-92941 and three others) with CVSS scores of 10 and 9.9, warning that any service running untrusted JavaScript in patriksimek/vm2 is at risk, without mentioning patches or active exploitation.
02094633
954 followersView on X
Alexius McMullin@McM1Alex44d
Disclosure
Four patriksimek vm2 sandbox escape vulnerabilities disclosed Sep 18. CVE-2026-92941: CVSS 10.0. Three others: all 9.9. Affects any service running untrusted JavaScript in-process. Perfect 10 means full system compromise with zero authentication required. #cybersecurity
Post summary
The text announces four vm2 sandbox escape vulnerabilities disclosed on Sep 18, with high CVSS scores and serious impact, but does not provide PoC, exploit tooling, active exploitation evidence, or remediation details.
0000038
18 followersView on X

Explore more

Back to dashboard