CVE-2026-92955

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.8

Description A sandbox escape exists in NodeVM that allows attackers to access the host proto getter/setter via console. stdout and console. stderr. By overwriting EventEmitter.prototype.emit and triggering process events, an attacker can execute code within the process context, effectively bypassing restrictions on code generation.

Recommendations Update to version 3.11.8 or later.