Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🔓 vm2 sandbox escape via __proto__ getter/setter — CVSS 10. CVE-2026-92955 allows full host compromise with no auth, no interaction. If you run vm2 in prod, treat it as critical now. #cybersecurity #nodejs #vulnerabilities #ciso https://secalerts.co/vulnerability/GHSA-88hf-g992-jg85?utm_campaign=x https://t.co/ICxZBj9iwp