vm2 before 3.11.6 Process-wide State Exposure via os and dns

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92960 · CVE overview and exploitation status

EUVD-2026-81610

GHSA-qj2x-7x9q-qgm7

GHSA-m5w8-4gq2-6f8x

cve-program · CVE-2026-92960

• https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x
• https://www.vulncheck.com/advisories/vm2-before-3.11.6-process-wide-state-exposure-via-os-and-dns

euvd · EUVD-2026-81610

• https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x
• https://www.vulncheck.com/advisories/vm2-before-3.11.6-process-wide-state-exposure-via-os-and-dns

nvd · CVE-2026-92960

• https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x
• https://www.vulncheck.com/advisories/vm2-before-3.11.6-process-wide-state-exposure-via-os-and-dns

osv · GHSA-m5w8-4gq2-6f8x

• https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x
• https://github.com/patriksimek/vm2/commit/768bcfc515b12884c31f7cc70c3a39e8fa7eda74
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/3.11.6

• vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f) · Advisory content revised · 5 Nov 2026
• vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host pro… · Advisory content revised · 1 Nov 2026