{
  "schemaVersion": 1,
  "incident": {
    "id": "cve-2026-92940",
    "url": "https://cveboard.org/i/cve-2026-92940",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-92940",
    "json": "https://cveboard.org/i/cve-2026-92940.json",
    "kind": "vuln",
    "live": false,
    "knownExploited": false,
    "severity": "critical",
    "title": "vm2 exposes host HTTPS credentials and TLS traffic through globalAgent",
    "summary": "vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request options and the host TLS socket whenever an unrelated host HTTPS request releases a pooled connection.",
    "titlePt": "vm2 expõe credenciais HTTPS do host e tráfego TLS através do globalAgent",
    "summaryPt": "vm2 3.11.6 expõe o https.globalAgent real do processo host quando um NodeVM é explicitamente permitido a requerer https. O módulo é envolvido como somente leitura, mas chamadas a métodos no agente compartilhado ainda mutam o objeto host. Código de sandbox pode registrar um ouvinte livre e receber opções de solicitação do host e o socket TLS do host sempre que uma solicitação HTTPS do host não relacionada libera uma conexão em pool.",
    "cves": [
      "CVE-2026-92940"
    ],
    "ghsa": "GHSA-h85j-hv3c-qfgq",
    "cvss": {
      "score": 10,
      "version": "3.1"
    },
    "epss": {
      "percentage": 0.00474,
      "percentile": 0.39507,
      "asOf": "2026-10-23"
    },
    "packages": [
      {
        "ecosystem": "npm",
        "name": "vm2",
        "vulnerable": ">= 3.11.3, <= 3.11.6",
        "fixed": "3.11.7",
        "advisory": "GHSA-h85j-hv3c-qfgq"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-h85j-hv3c-qfgq"
      }
    ],
    "publishedAt": "2026-10-01T15:38:26.000Z",
    "updatedAt": "2026-10-01T15:38:26.000Z"
  },
  "live": false,
  "events": [
    {
      "id": "ghsa:GHSA-h85j-hv3c-qfgq:ghsa_published:2026-10-01T15:38:26.000Z",
      "incidentId": "cve-2026-92940",
      "type": "ghsa_published",
      "at": "2026-10-01T15:38:26.000Z",
      "detail": {
        "ghsa": "GHSA-h85j-hv3c-qfgq",
        "severity": "critical",
        "fixed": "3.11.7"
      }
    }
  ]
}