CVE-2026-92955

Summary

This vulnerability allows attackers to escape the sandbox and execute arbitrary code with process context, bypassing security restrictions.

Exploitability

Exploitation is relatively straightforward given the preconditions of running a vulnerable version of vm2 and having access to console._stdout or console._stderr.

Blast radius

If exploited, this could lead to complete compromise of the host system, including data theft, unauthorized code execution, and potential lateral movement.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to vm2 version 3.11.8 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.