---
title: "CVE-2026-92949: vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor"
url: https://erroneo.us/security/cve/CVE-2026-92949/
description: "CVE-2026-92949 (patriksimek vm2): vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-09-17
date_modified: 2026-10-07
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-92949"
kev: false
cvss: 6.3
epss: 0.00319
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-92949: vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.3% , percentile 24: FIRST’s model estimates a 0.3% chance of exploitation activity in the next 30 days, higher than 24% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Editorial verdict: Check exposure. vm2: 22 Critical Sandbox Escapes, Fixed in 3.12.2 — If anything outside your trust boundary can get code into vm2, upgrade to 3.12.2 today and plan to move that code out of process; if vm2 only runs your own code, upgrade on a normal cycle.

## What it is

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or lookupSetter() to extract and invoke host object setters directly, mutating properties the embedder explicitly marked read-only.

## Affected products (CVE record)

- patriksimek vm2: 3.9.6 < 3.11.7

## Severity

- VulnCheck CVSS 4.0: 6.3 `CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N`
- VulnCheck CVSS 3.1: 4 `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 0.32% probability of exploitation activity in the next 30 days; percentile 24.

## Sources

- [GitHub Security Advisory (GHSA-633r-hq9m-c4ff)](https://github.com/patriksimek/vm2/security/advisories/GHSA-633r-hq9m-c4ff)
- [CVE.org record CVE-2026-92949](https://www.cve.org/CVERecord?id=CVE-2026-92949)
- [NVD entry CVE-2026-92949](https://nvd.nist.gov/vuln/detail/CVE-2026-92949)
- [VulnCheck Advisory: vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor](https://www.vulncheck.com/advisories/vm2-3.9.6-before-3.11.7-sandbox-bypass-via-accessor-descriptor)

---
Source page: https://erroneo.us/security/cve/CVE-2026-92949/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt