vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92949 · CVE overview and exploitation status

EUVD-2026-81598

GHSA-9f3g-34x8-92jc

GHSA-633r-hq9m-c4ff

cve-program · CVE-2026-92949

• https://github.com/patriksimek/vm2/security/advisories/GHSA-633r-hq9m-c4ff
• https://www.vulncheck.com/advisories/vm2-3.9.6-before-3.11.7-sandbox-bypass-via-accessor-descriptor

euvd · EUVD-2026-81598

• https://github.com/patriksimek/vm2/security/advisories/GHSA-633r-hq9m-c4ff
• https://www.vulncheck.com/advisories/vm2-3.9.6-before-3.11.7-sandbox-bypass-via-accessor-descriptor

nvd · CVE-2026-92949

• https://github.com/patriksimek/vm2/security/advisories/GHSA-633r-hq9m-c4ff
• https://www.vulncheck.com/advisories/vm2-3.9.6-before-3.11.7-sandbox-bypass-via-accessor-descriptor

osv · GHSA-633r-hq9m-c4ff

• https://github.com/patriksimek/vm2/security/advisories/GHSA-633r-hq9m-c4ff
• https://nvd.nist.gov/vuln/detail/CVE-2026-92949
• https://github.com/patriksimek/vm2/commit/d6ef73bd46488102dae8f4bc35f3f3c0eba2ea64
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.7
• https://www.vulncheck.com/advisories/vm2-3.9.6-before-3.11.7-sandbox-bypass-via-accessor-descriptor

osv · GHSA-9f3g-34x8-92jc

• https://github.com/patriksimek/vm2/security/advisories/GHSA-633r-hq9m-c4ff
• https://nvd.nist.gov/vuln/detail/CVE-2026-92949
• https://www.vulncheck.com/advisories/vm2-3.9.6-before-3.11.7-sandbox-bypass-via-accessor-descriptor

No related changes are available here.