CVE-2026-92949

Name of the Vulnerable Software and Affected Versions vm2 versions 3.9.6 through 3.11.6

Description Insufficient restriction of access to accessor properties on frozen objects allows sandboxed scripts to bypass protections provided by vm.freeze() and vm.readonly(). Attackers can utilize Object.getOwnPropertyDescriptor() or lookupSetter () to extract and invoke host object setters directly, enabling the mutation of properties that were explicitly marked as read-only by the embedder.

Recommendations Update vm2 to version 3.11.7 or later.