Quick answers
- Is CVE-2026-92963 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-92963 being exploited in the wild.
- How severe is CVE-2026-92963?
- Medium severity, with a CVSS score of 5.3, published 17 September 2026.
- Which products and versions are affected?
- vm2 (npm) < 3.11.2, SEMVER:introduced=0,fixed=3.11.2.
- Is there a fix for CVE-2026-92963?
- Yes. vm2 (npm): upgrade to 3.11.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-92963 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-92963?
- Check whether you run vm2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- vm2 (npm): upgrade to 3.11.2 or later
npm install vm2@3.11.2
Technical details
The vulnerability is an information disclosure issue (CWE-693) in vm2's sandbox isolation mechanism. A prior patch (GHSA-wp5r-2gw5-m7q7) attempted to restrict access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`, but the fix was incomplete. An attacker can bypass the restriction by using computed-key access on globalThis (e.g., `globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']`) to retrieve the internal state object. This requires no privileges, no user interaction, and is reachable over the network from any VM instance. The impact is low confidentiality loss; access to internal state does not directly achieve code execution but may leak sensitive bridge information or enable chained attacks. A fix was released in version 3.11.2.
Affected products
- patriksimek vm2 <3.11.2
Identifiers
- CVE-2026-92963
- GHSA-2cm2-m3w5-gp2f
Timeline
- 2026-05-03: disclosed
- 2026-05-03: patched: Fixed in version 3.11.2