VulnSocial

CVE-2026-92960

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver globally, redirecting all subsequent host DNS queries through an attacker-controlled resolver.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-01: 110-01
Full discourse1 post
  • DFIR Lab@DFIR_Lab

    🚨 CRITICAL: CVE-2026-92960 | CVSS 10.0 vm2 <3.11.6 sandbox escape allows attackers to hijack DNS resolver & read host process data via builtin: ['*'] misconfiguration. Patch immediately to 3.11.6+ #CVE #Vulnerability #PatchNow https://t.co/3jWKcL5ATx

    0000028
    140 followersView on X

Explore more

Back to dashboard