CVE-2026-92949 patriksimek CVE debrief

Who should care

Defenders responsible for systems using vm2 should assess exposure and prioritize remediation. This vulnerability could allow unauthorized modifications to properties marked read-only.

Why it matters

CVE-2026-92949 is a medium-severity vulnerability in vm2 that allows sandboxed scripts to bypass protections. Defenders should assess exposure, prioritize remediation, and verify vm2 versions to prevent potential unauthorized property modifications.

• Potential unauthorized property modifications
• Bypass of sandbox protections (vm.freeze() and vm.readonly())
• Possible elevation of privileges within sandboxed environments
• Need for verification of vm2 versions and exposure

Technical summary

The vulnerability allows sandboxed scripts to bypass vm.freeze() and vm.readonly() protections in vm2 versions from 3.9.6 before 3.11.7. Attackers can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to extract and invoke host object setters directly, mutating properties marked read-only by the embedder. This vulnerability has significant implications for defenders, as it could allow unauthorized modifications to properties marked read-only. Further analysis is needed to determine the full impact of this vulnerability.

Defensive priority

Defenders should prioritize verifying vm2 versions and assessing exposure, as sandbox bypass could lead to unauthorized property modifications.

Recommended defensive actions

• Verify vm2 version and upgrade to 3.11.7 or later if possible
• Assess exposure and prioritize remediation for affected systems
• Monitor for potential unauthorized property modifications
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify versions beyond vm2. The vendor and affected products remain unknown. Further verification is needed to determine the full scope of affected systems and potential exposure. Defenders should review the official CVE record and NVD entry for additional information. The vulnerability allows sandboxed scripts to bypass vm.freeze() and vm.readonly() protections in vm2 versions from 3.9.6 before 3.11.7.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.