CVE-2026-92960

CVSS 10.0 (critical) · published 2026-09-17

vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver globally, redirecting all subsequent host DNS queries through an attacker-controlled resolver.

Weakness: CWE-200

Source: NVD CVE-2026-92960

References

• https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x
• https://www.vulncheck.com/advisories/vm2-before-3.11.6-process-wide-state-exposure-via-os-and-dns
• https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.