CVE-2026-92949: vm2 Package Allows Bypass of Read-Only Protection via Accessor Descriptor
Summary
CVE-2026-92949: vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor. Affects vm2 versions >= 3.9.6, < 3.11.7. Fixed in 3.11.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for running untrusted JavaScript code. It allows developers to execute code securely by isolating it from the host environment. However, a vulnerability has been discovered that allows untrusted scripts to bypass the read-only protections intended to prevent modifications to host objects, potentially leading to unauthorized access or manipulation of sensitive data.
Vulnerability Detail
The vulnerability arises from the ability of untrusted JavaScript running inside vm2 to bypass the vm.freeze() and vm.readonly() methods, which are designed to prevent modifications to host objects. Specifically, if a host object has an accessor property (with a getter and setter), the sandboxed script can exploit this by using Object.getOwnPropertyDescriptor() to access the setter and invoke it directly. This allows the script to mutate the host object, violating the intended read-only contract. The impact of this vulnerability can vary based on what the embedder has frozen, and if the setter affects control flow, it could lead to further exploitation.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.7
This is the first release that contains the fix.
npm install vm2@3.11.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid exposing host objects with accessor properties to the sandboxed environment. Instead, consider using data properties that do not allow for direct mutation through accessor methods.
Conclusion
The vm2 package has a vulnerability (CVE-2026-92949) that allows untrusted scripts to bypass read-only protections on host objects. It is crucial for developers using this package to update to the patched version (3.11.7 or later) to ensure the security of their applications. Additionally, using Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score for this vulnerability is 4.0, indicating a moderate severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can allow untrusted scripts to modify host objects, potentially leading to unauthorized access or manipulation of sensitive data.
Yes, you can mitigate the issue by avoiding the exposure of host objects with accessor properties to the sandboxed environment.
vm2 is a Node.js library that provides a secure sandboxed environment for executing untrusted JavaScript code, allowing developers to run code safely without affecting the host environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
