CVE-2026-92963 in vm2

Resumen

por MITRE • 2026-09-17

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsable: VulnCheck
• Reservar: 2026-09-17
• Divulgación: 2026-09-17
• Moderación: aceptado
• Artículo: VDB-406457
• CPE: listo
• CWE: CWE-200 (confirmado)
• CVSS: 5.3 (CNA)
• EPSS: 0.00000
• KEV: no
• Actividades: muy bajo

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-92963
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92963
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-92963/