Is CVE-2026-92962 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92962 being exploited in the wild.

How severe is CVE-2026-92962?

Medium severity, with a CVSS score of 4, published 17 September 2026.

Which products and versions are affected?

vm2 (npm) SEMVER:introduced=0,fixed=3.11.4.

Is there a fix for CVE-2026-92962?

Yes. vm2 (npm): upgrade to 3.11.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92962 attacked?

It is attacked with local access.

Am I affected by CVE-2026-92962?

Check whether you run vm2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92962: vm2 Defense Invariant #11 violation in stack-trace formatter

CVE-2026-92962 · Severity: medium · CVSS 4 · Published 2026-09-17

vm2 is a JavaScript sandbox that isolates untrusted code execution. The stack-trace formatter in vm2 fails to properly isolate internal operations from sandbox code, allowing sandboxed JavaScript to install custom handlers that intercept the formatter's internal data writes. While the current impact is limited to observing stack frame information, this violates a critical design principle that prevents future sandbox escapes through object-passing channels.

Technologies: vm2 (npm). Vendors: npm.

Quick answers

Is CVE-2026-92962 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92962 being exploited in the wild.
How severe is CVE-2026-92962?: Medium severity, with a CVSS score of 4, published 17 September 2026.
Which products and versions are affected?: vm2 (npm) SEMVER:introduced=0,fixed=3.11.4.
Is there a fix for CVE-2026-92962?: Yes. vm2 (npm): upgrade to 3.11.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92962 attacked?: It is attacked with local access.
Am I affected by CVE-2026-92962?: Check whether you run vm2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vm2 (npm): upgrade to 3.11.4 or later
```
npm install vm2@3.11.4
```

Technical details

The vulnerability is a Defense Invariant #11 violation in defaultSandboxPrepareStackTrace (lib/setup-sandbox.js, lines 605–607), where stack frame data is appended to an internal array using prototype-walking index assignment (lines[lines.length] = value). This pattern allows sandbox-installed Array.prototype[N] setters to fire during the bridge's stack formatting, enabling observation and interception of each appended line. The attack requires no authentication or external network access—only the ability to run code in the sandbox. The current payload is a string after CallSite.toString(), limiting direct impact to a side channel; however, future changes enriching the appended record with host-realm object references would re-expose the GHSA-9qj6 attack shape. The fix mirrors the GHSA-9qj6 patch: use localReflectDefineProperty to create own data properties and bypass the prototype chain.

Affected products

Patriksimek vm2 <=3.11.3

Identifiers

CVE-2026-92962
GHSA-q3fm-4wcw-g57x

Timeline

2026-05-29: disclosed
2026-05-29: patched: Fixed in version 3.11.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.