← Back to CVE List
CVE-2026-92960NVD
Vulnerability Summary
vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver globally, redirecting all subsequent host DNS queries through an attacker-controlled resolver.
CVSS v4.0 Base Metrics — Score 10.0 (CRITICAL)
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredNone
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)High
Availability (Vulnerable System)Low
Confidentiality (Subsequent System)High
Integrity (Subsequent System)High
Availability (Subsequent System)Low
CVSS v3.1 Base Metrics — Score 10.0 (CRITICAL)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityLow
Affected & Patched Versions
- patriksimek vm2 < 3.11.6
- patriksimek vm2 3.11.6