CVE-2026-92960

Summary

This flaw allows attackers to read host process identity and network topology, and hijack the host process DNS resolver, leading to potential data exfiltration and DNS spoofing.

Exploitability

Exploitation is relatively straightforward given the preconditions of having access to the sandbox code and the 'builtin: ['*']' configuration.

Blast radius

If exploited, the impact could be severe, including unauthorized access to sensitive information and control over DNS queries, potentially leading to broader network compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to vm2 version 3.11.6 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.