Vulnerability-Lookup

GHSA-JF8Q-945G-9Q4C

Vulnerability from github – Published: 2026-10-01 15:42 – Updated: 2026-10-01 15:42

Summary

vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks

Details

Summary

vm2 current head (v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92) still exposes registered Node.js internal symbols from host WebStream prototypes to sandbox code.

The prior nodejs.* symbol hardening blocks Symbol.for('nodejs.<name>') at the source, but the extraction filters and bridge write traps still enumerate a fixed set of known registered symbols. On Node.js v25.8.0, stream/web exposes two additional registered symbols:

nodejs.stream.disturbed
nodejs.stream.errored

Sandbox code can extract those real host symbols with Object.getOwnPropertySymbols(streamWeb.ReadableStream.prototype) and then use them as write keys on host objects. On a real host ReadableStream, an attacker can make stream.Readable.isDisturbed(stream) return false after the stream has already been read.

Technical Details

lib/setup-sandbox.js correctly blocks future nodejs.* keys at the Symbol.for() source:

if (apply(localStringStartsWith, keyStr, ['nodejs.'])) {
  ...
  return fresh;
}

However, the extraction filters are still driven by a fixed realDangerousSymbols list. That list does not include nodejs.stream.disturbed or nodejs.stream.errored, so Object.getOwnPropertySymbols() and related paths can still return those real host symbols.

lib/bridge.js has the same fixed-list problem in isDangerousCrossRealmSymbol() and in the host-result scrub list. Because the two new symbols are not recognized, the set and defineProperty traps allow sandbox-originated writes using those keys.

Current-head source references:

lib/setup-sandbox.js:180-196 denies Symbol.for('nodejs.*') by namespace.
lib/setup-sandbox.js:214-230 uses a fixed realDangerousSymbols list for extraction filtering; the two reported symbols are absent.
lib/bridge.js:187-199 uses a fixed isDangerousCrossRealmSymbol() list; the two reported symbols are absent.
lib/bridge.js:1499-1509 treats the write trap as the last line of defense, but it only rejects keys recognized by that fixed list.

Impact

Sandbox code can corrupt host-visible WebStream state checks for host WebStream objects that cross into the sandbox. In the validated PoV, a stream that the host has already consumed is made to appear undisturbed to stream.Readable.isDisturbed().

This can bypass host logic that relies on Node's public stream-state helpers to enforce one-shot body consumption, reject errored streams, or decide whether a host WebStream is safe to hand to another component.

This is not a host-code-execution primitive in the current PoV. The report is an incomplete-fix / guard-coverage gap in the same symbol-boundary family as the prior nodejs.* symbol advisory.

Affected Package/Versions

Confirmed affected on Node.js v25.8.0:

v3.11.4
v3.11.5
current head 7a1f5100b96f48d34e0fe104ab37c0acc5944f92

v3.11.3 is also affected, but it predates the broader nodejs.* symbol fix. For this incomplete-fix report, the suggested affected range is >= 3.11.4, <= 3.11.5 on Node.js versions where these stream symbols exist.

No patched version is known.

Configuration Required

The PoV uses a VM where the embedder exposes a host WebStream object and the host stream/web module object to sandbox code:

const vm = new VM({ sandbox: { rs, streamWeb } });

This matches the same trust boundary as the earlier cross-realm symbol-write class: sandbox code must not be able to obtain registered Node.js internal symbols and write them back onto host objects.

The PoV is local-only. It does not require network access, a public target, NodeVM builtin access, process, filesystem access, or child-process access.

Local Proof of Concept

Run from the oss-zero-day-harness directory:

node submission-bundle/vm2-pov-test-incomplete-nodejs-stream-symbol-filter/pov-nodejs-stream-symbol-incomplete-fix.js

The PoV:

The host creates a ReadableStream.
The host reads one chunk so stream.Readable.isDisturbed(rs) is true.
Sandbox code confirms Symbol.for('nodejs.stream.disturbed') is blocked and returns a sandbox-local symbol.
Sandbox code extracts the real registered nodejs.stream.disturbed / nodejs.stream.errored symbols from the host ReadableStream.prototype.
Sandbox code writes an own nodejs.stream.disturbed property onto the host stream with value false.
The host calls stream.Readable.isDisturbed(rs) again and receives false.

Observed result on current head:

{
  "beforeHostDisturbed": true,
  "controls": {
    "symbolForDisturbedIsRegistered": false,
    "symbolForErroredIsRegistered": false
  },
  "extracted": [
    {
      "description": "nodejs.stream.disturbed",
      "keyFor": "nodejs.stream.disturbed"
    },
    {
      "description": "nodejs.stream.errored",
      "keyFor": "nodejs.stream.errored"
    }
  ],
  "overrideDisturbedOk": true,
  "afterHostDisturbed": false
}

Official Disclosure Policy Fit

vm2's SECURITY.md asks reporters not to create a public issue and to submit It asks for reproduction steps, affected versions, environment/configuration details, and potential impact:

Policy: https://github.com/patriksimek/vm2/blob/main/SECURITY.md
Private report route: https://github.com/patriksimek/vm2/security/advisories/new

This bundle is formatted for that private GitHub report flow and should not be posted publicly before maintainer triage and a fixed release.

Suggested Fix Direction

Make the dangerous-symbol checks namespace-based instead of list-based:

In setup-sandbox.js, make isDangerousSymbol(sym) return true for any registered symbol whose Symbol.keyFor(sym) starts with nodejs..
In bridge.js, make isDangerousCrossRealmSymbol(key) do the same for any symbol key crossing the bridge.
In host-result scrubbing, delete all own symbol keys whose registered key starts with nodejs. instead of iterating a hard-coded list.
Keep the current explicit list only as regression documentation, not as the complete security boundary.

Regression tests should include:

Object.getOwnPropertySymbols(ReadableStream.prototype) must not expose nodejs.stream.disturbed or nodejs.stream.errored.
A sandbox-local Symbol.for('nodejs.stream.disturbed') write must not affect host stream.Readable.isDisturbed().
Even if the real symbol is passed into the sandbox by a host test harness, set, defineProperty, and deleteProperty traps must reject writes and deletes against host objects.

Why This Is Not Intended Behavior

The hardening comments and tests establish the intended invariant:

any nodejs.* internal symbol should be sandbox-local when requested through Symbol.for();
dangerous registered symbols should not be enumerable/extractable from host objects;
even if a sandbox obtains one, bridge write traps should reject writes using that key.

This report shows that the source-side rule is active, but the extraction and write-trap rules are incomplete for newer registered nodejs.stream.* symbols.

Node's stream state helpers consult these symbols directly. For example, stream.Readable.isDisturbed() reads the internal disturbed symbol before falling back to public state. After sandbox writes an own property under the extracted symbol, the host helper returns attacker-controlled state.

Node's public documentation describes stream.isErrored(stream) as reporting whether a stream has encountered an error, and stream.Readable.isDisturbed(stream) as reporting whether the stream has been read from or cancelled:

https://nodejs.org/api/stream.html#streamiserroredstream
https://nodejs.org/api/stream.html#streamreadableisdisturbedstream

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.11.6"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vm2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.11.4"
            },
            {
              "fixed": "3.11.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-92952"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-669"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-01T15:42:15Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nvm2 current head (`v3.11.5`, commit `7a1f5100b96f48d34e0fe104ab37c0acc5944f92`) still exposes registered Node.js internal symbols from host WebStream prototypes to sandbox code.\n\nThe prior `nodejs.*` symbol hardening blocks `Symbol.for(\u0027nodejs.\u003cname\u003e\u0027)` at the source, but the extraction filters and bridge write traps still enumerate a fixed set of known registered symbols. On Node.js `v25.8.0`, `stream/web` exposes two additional registered symbols:\n\n- `nodejs.stream.disturbed`\n- `nodejs.stream.errored`\n\nSandbox code can extract those real host symbols with `Object.getOwnPropertySymbols(streamWeb.ReadableStream.prototype)` and then use them as write keys on host objects. On a real host `ReadableStream`, an attacker can make `stream.Readable.isDisturbed(stream)` return `false` after the stream has already been read.\n\n## Technical Details\n\n`lib/setup-sandbox.js` correctly blocks future `nodejs.*` keys at the `Symbol.for()` source:\n\n```js\nif (apply(localStringStartsWith, keyStr, [\u0027nodejs.\u0027])) {\n  ...\n  return fresh;\n}\n```\n\nHowever, the extraction filters are still driven by a fixed `realDangerousSymbols` list. That list does not include `nodejs.stream.disturbed` or `nodejs.stream.errored`, so `Object.getOwnPropertySymbols()` and related paths can still return those real host symbols.\n\n`lib/bridge.js` has the same fixed-list problem in `isDangerousCrossRealmSymbol()` and in the host-result scrub list. Because the two new symbols are not recognized, the `set` and `defineProperty` traps allow sandbox-originated writes using those keys.\n\nCurrent-head source references:\n\n- `lib/setup-sandbox.js:180-196` denies `Symbol.for(\u0027nodejs.*\u0027)` by namespace.\n- `lib/setup-sandbox.js:214-230` uses a fixed `realDangerousSymbols` list for extraction filtering; the two reported symbols are absent.\n- `lib/bridge.js:187-199` uses a fixed `isDangerousCrossRealmSymbol()` list; the two reported symbols are absent.\n- `lib/bridge.js:1499-1509` treats the write trap as the last line of defense, but it only rejects keys recognized by that fixed list.\n\n## Impact\n\nSandbox code can corrupt host-visible WebStream state checks for host WebStream objects that cross into the sandbox. In the validated PoV, a stream that the host has already consumed is made to appear undisturbed to `stream.Readable.isDisturbed()`.\n\nThis can bypass host logic that relies on Node\u0027s public stream-state helpers to enforce one-shot body consumption, reject errored streams, or decide whether a host WebStream is safe to hand to another component.\n\nThis is not a host-code-execution primitive in the current PoV. The report is an incomplete-fix / guard-coverage gap in the same symbol-boundary family as the prior `nodejs.*` symbol advisory.\n\n## Affected Package/Versions\n\nConfirmed affected on Node.js `v25.8.0`:\n\n- `v3.11.4`\n- `v3.11.5`\n- current head `7a1f5100b96f48d34e0fe104ab37c0acc5944f92`\n\n`v3.11.3` is also affected, but it predates the broader `nodejs.*` symbol fix. For this incomplete-fix report, the suggested affected range is `\u003e= 3.11.4, \u003c= 3.11.5` on Node.js versions where these stream symbols exist.\n\nNo patched version is known.\n\n## Configuration Required\n\nThe PoV uses a `VM` where the embedder exposes a host WebStream object and the host `stream/web` module object to sandbox code:\n\n```js\nconst vm = new VM({ sandbox: { rs, streamWeb } });\n```\n\nThis matches the same trust boundary as the earlier cross-realm symbol-write class: sandbox code must not be able to obtain registered Node.js internal symbols and write them back onto host objects.\n\nThe PoV is local-only. It does not require network access, a public target, `NodeVM` builtin access, `process`, filesystem access, or child-process access.\n\n## Local Proof of Concept\n\nRun from the `oss-zero-day-harness` directory:\n\n```sh\nnode submission-bundle/vm2-pov-test-incomplete-nodejs-stream-symbol-filter/pov-nodejs-stream-symbol-incomplete-fix.js\n```\n\nThe PoV:\n\n1. The host creates a `ReadableStream`.\n2. The host reads one chunk so `stream.Readable.isDisturbed(rs)` is `true`.\n3. Sandbox code confirms `Symbol.for(\u0027nodejs.stream.disturbed\u0027)` is blocked and returns a sandbox-local symbol.\n4. Sandbox code extracts the real registered `nodejs.stream.disturbed` / `nodejs.stream.errored` symbols from the host `ReadableStream.prototype`.\n5. Sandbox code writes an own `nodejs.stream.disturbed` property onto the host stream with value `false`.\n6. The host calls `stream.Readable.isDisturbed(rs)` again and receives `false`.\n\nObserved result on current head:\n\n```json\n{\n  \"beforeHostDisturbed\": true,\n  \"controls\": {\n    \"symbolForDisturbedIsRegistered\": false,\n    \"symbolForErroredIsRegistered\": false\n  },\n  \"extracted\": [\n    {\n      \"description\": \"nodejs.stream.disturbed\",\n      \"keyFor\": \"nodejs.stream.disturbed\"\n    },\n    {\n      \"description\": \"nodejs.stream.errored\",\n      \"keyFor\": \"nodejs.stream.errored\"\n    }\n  ],\n  \"overrideDisturbedOk\": true,\n  \"afterHostDisturbed\": false\n}\n```\n\n## Official Disclosure Policy Fit\n\nvm2\u0027s `SECURITY.md` asks reporters not to create a public issue and to submit It asks for reproduction steps, affected versions, environment/configuration details, and potential impact:\n\n- Policy: https://github.com/patriksimek/vm2/blob/main/SECURITY.md\n- Private report route: https://github.com/patriksimek/vm2/security/advisories/new\n\nThis bundle is formatted for that private GitHub report flow and should not be posted publicly before maintainer triage and a fixed release.\n\n## Suggested Fix Direction\n\nMake the dangerous-symbol checks namespace-based instead of list-based:\n\n- In `setup-sandbox.js`, make `isDangerousSymbol(sym)` return true for any registered symbol whose `Symbol.keyFor(sym)` starts with `nodejs.`.\n- In `bridge.js`, make `isDangerousCrossRealmSymbol(key)` do the same for any symbol key crossing the bridge.\n- In host-result scrubbing, delete all own symbol keys whose registered key starts with `nodejs.` instead of iterating a hard-coded list.\n- Keep the current explicit list only as regression documentation, not as the complete security boundary.\n\nRegression tests should include:\n\n- `Object.getOwnPropertySymbols(ReadableStream.prototype)` must not expose `nodejs.stream.disturbed` or `nodejs.stream.errored`.\n- A sandbox-local `Symbol.for(\u0027nodejs.stream.disturbed\u0027)` write must not affect host `stream.Readable.isDisturbed()`.\n- Even if the real symbol is passed into the sandbox by a host test harness, `set`, `defineProperty`, and `deleteProperty` traps must reject writes and deletes against host objects.\n\n## Why This Is Not Intended Behavior\n\nThe hardening comments and tests establish the intended invariant:\n\n- any `nodejs.*` internal symbol should be sandbox-local when requested through `Symbol.for()`;\n- dangerous registered symbols should not be enumerable/extractable from host objects;\n- even if a sandbox obtains one, bridge write traps should reject writes using that key.\n\nThis report shows that the source-side rule is active, but the extraction and write-trap rules are incomplete for newer registered `nodejs.stream.*` symbols.\n\nNode\u0027s stream state helpers consult these symbols directly. For example, `stream.Readable.isDisturbed()` reads the internal disturbed symbol before falling back to public state. After sandbox writes an own property under the extracted symbol, the host helper returns attacker-controlled state.\n\nNode\u0027s public documentation describes `stream.isErrored(stream)` as reporting whether a stream has encountered an error, and `stream.Readable.isDisturbed(stream)` as reporting whether the stream has been read from or cancelled:\n\n- https://nodejs.org/api/stream.html#streamiserroredstream\n- https://nodejs.org/api/stream.html#streamreadableisdisturbedstream",
  "id": "GHSA-jf8q-945g-9q4c",
  "modified": "2026-10-01T15:42:15Z",
  "published": "2026-10-01T15:42:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-jf8q-945g-9q4c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92952"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/commit/a45444d5abbdfa59055528f584df5f21cc7c42da"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/patriksimek/vm2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.7"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/vm2-3.11.4-through-3.11.6-sandbox-symbol-filtering-bypass"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks"
}

CVE-2026-92952 (GCVE-0-2026-92952)

Vulnerability from cvelistv5 – Published: 2026-09-17 13:46 – Updated: 2026-09-17 15:44

Title

vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass

Summary

vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known dangerous registered symbols that omits nodejs.stream.disturbed and nodejs.stream.errored, which are exposed on host WebStream prototypes on newer Node.js releases (validated on Node.js v25.8.0). When the embedder exposes a host WebStream object and the host stream/web module to the sandbox, sandbox code can obtain the real host symbols via Object.getOwnPropertySymbols(streamWeb.ReadableStream.prototype) and use them as write keys on host stream objects, corrupting host-visible stream state — for example making stream.Readable.isDisturbed() return false for an already-consumed stream. This can bypass host logic that relies on Node's public stream-state helpers to enforce one-shot body consumption, reject errored streams, or decide whether a stream is safe to hand to another component. It is not a host code-execution primitive in the reported proof of vulnerability. This is an incomplete fix for the earlier nodejs.* symbol filtering issue. Fixed in vm2 3.11.7.

Severity

8.9 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 15:43 UTC

CWE

CWE-669 - Incorrect Resource Transfer Between Spheres

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/patriksimek/vm2/security/advis…	vendor-advisory
https://www.vulncheck.com/advisories/vm2-3.11.4-t…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
patriksimek	vm2	Affected: 3.11.4 , < 3.11.7 (semver) Unaffected: 3.11.7 (semver)

Date Public

2026-08-24 00:00

Credits

rexpository

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92952",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T15:43:38.750643Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T15:44:51.213Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-jf8q-945g-9q4c"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/vm2",
          "product": "vm2",
          "vendor": "patriksimek",
          "versions": [
            {
              "lessThan": "3.11.7",
              "status": "affected",
              "version": "3.11.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.11.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "rexpository"
        }
      ],
      "datePublic": "2026-08-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known dangerous registered symbols that omits nodejs.stream.disturbed and nodejs.stream.errored, which are exposed on host WebStream prototypes on newer Node.js releases (validated on Node.js v25.8.0). When the embedder exposes a host WebStream object and the host stream/web module to the sandbox, sandbox code can obtain the real host symbols via Object.getOwnPropertySymbols(streamWeb.ReadableStream.prototype) and use them as write keys on host stream objects, corrupting host-visible stream state \u2014 for example making stream.Readable.isDisturbed() return false for an already-consumed stream. This can bypass host logic that relies on Node\u0027s public stream-state helpers to enforce one-shot body consumption, reject errored streams, or decide whether a stream is safe to hand to another component. It is not a host code-execution primitive in the reported proof of vulnerability. This is an incomplete fix for the earlier nodejs.* symbol filtering issue. Fixed in vm2 3.11.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-669",
              "description": "Incorrect Resource Transfer Between Spheres",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T13:46:11.469Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-jf8q-945g-9q4c)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-jf8q-945g-9q4c"
        },
        {
          "name": "VulnCheck Advisory: vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vm2-3.11.4-through-3.11.6-sandbox-symbol-filtering-bypass"
        }
      ],
      "title": "vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-92952",
    "datePublished": "2026-09-17T13:46:11.469Z",
    "dateReserved": "2026-09-17T12:43:03.568Z",
    "dateUpdated": "2026-09-17T15:44:51.213Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-JF8Q-945G-9Q4C

Summary

Technical Details

Impact

Affected Package/Versions

Configuration Required

Local Proof of Concept

Official Disclosure Policy Fit

Suggested Fix Direction

Why This Is Not Intended Behavior

CVE-2026-92952 (GCVE-0-2026-92952)

Tags

Sightings

Nomenclature

Related by attack behaviour