CVE-2026-92960CWE-200information-disclosure

CVE-2026-92960

Critical · published September 17, 2026

CVSS v3.1
10.0
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver globally, redirecting all subsequent host DNS queries through an attacker-controlled resolver.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
EPSS
0.00474 · 40.0th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-09-17T18:18Z
References (3)
https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x · [email protected]https://www.vulncheck.com/advisories/vm2-before-3.11.6-process-wide-state-exposure-via-os-and-dns · [email protected]https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 13:46Z
    vm2 before 3.11.6 Process-wide State Exposure via os and dns
    cvelistv5