CVE-2026-92955
vm2: Sandbox Escape (NodeVM)
It being possible to obtain the host proto getter/setter, has been used in many reports:
- No known exploitation
- Severity
- Critical, CVSS 10.0 (v4.0)
- EPSS
- 0.71% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vm2 (npm) <= 3.11.7, fixed in 3.11.8 · GHSA-88hf-g992-jg85