CVE-2026-92940 in vm2
Summary
by MITRE • 09/17/2026
vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent's 'free' event. When an unrelated host HTTPS request releases a pooled connection, the listener receives the live host request options and the host TLSSocket, allowing sandboxed code to read the host's Authorization header and private destination host/port, attach a data listener to the released socket and read subsequent host response bodies in plaintext, and issue attacker-chosen authenticated requests using the stolen credentials. The issue is fixed in 3.11.7.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in vm2 versions 3.11.3 through 3.11.6 represents a critical sandbox escape mechanism that allows untrusted code to access sensitive host process resources, specifically the global HTTPS agent and associated network connections. This flaw arises from an incomplete isolation strategy within the builtin loader when NodeVM is explicitly configured to permit the require of the https module. While the implementation correctly wraps most host modules in read-only proxies to prevent direct modification, it fails to adequately isolate event emitter methods on specific prototype objects like Agent.prototype. Consequently, method calls such as on() are forwarded directly to the underlying host object rather than being sandboxed or intercepted, creating a bridge between the isolated execution environment and the privileged host process context.
From a technical perspective, this architectural oversight enables sandboxed code to register event listeners for critical lifecycle events of the global HTTPS agent, particularly the free event which triggers when an unused pooled connection is released back into the pool by unrelated host requests. When such an event occurs, the listener invoked within the sandbox receives arguments containing live host request options and the actual TLSSocket object associated with that connection. This exposure provides the attacker with direct access to sensitive metadata including Authorization headers carrying credentials, as well as private destination hostnames and port numbers that were intended to remain hidden from the untrusted environment. The presence of these objects in the sandbox context effectively breaks the security boundary established by vm2.
The operational impact of this vulnerability is severe, enabling a range of malicious activities ranging from data exfiltration to request forgery. Once the attacker has access to the TLSSocket and host options within the sandbox, they can attach additional data listeners to monitor subsequent traffic flowing over that connection. This allows for the plaintext reading of response bodies containing sensitive information such as session tokens, personal identifiable information, or proprietary business logic. Furthermore, because the agent retains authentication credentials from the original request context, the attacker can leverage these stolen secrets to issue authenticated requests on behalf of the host process. This capability facilitates unauthorized access to backend services and potential lateral movement within internal networks by impersonating legitimate service accounts using compromised tokens.
This vulnerability aligns with CWE-200 Information Exposure and CWE-94 Code Injection in the context of sandbox escape, as it allows untrusted code to observe and interact with restricted host resources. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1537 Attempt to Remove Defenses by bypassing application isolation mechanisms and potentially T1078 Valid Accounts if the stolen credentials are used for further access. The root cause lies in the improper handling of event emitter prototypes within the proxy layer, where forwarding method calls without sanitizing their arguments or context allows sensitive host state to leak into the sandboxed environment.
To mitigate this risk, organizations must immediately upgrade vm2 to version 3.11.7 or later, which addresses these specific flaws in the builtin loader and event handling logic. Until an update is applied, it is advisable to avoid using NodeVM with enabled https require capabilities if untrusted code execution is a possibility. Additionally, implementing strict Content Security Policies for server-side JavaScript environments and minimizing the use of global agents that retain persistent credentials can reduce the attack surface. Regular auditing of third-party dependencies for known sandbox escape vulnerabilities remains essential given the complexity of isolating dynamic script execution contexts in Node.js applications.