Critical severity10.0NVD Advisory· Published Sep 17, 2026· Updated Sep 17, 2026
CVE-2026-92960
CVE-2026-92960
Description
vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver globally, redirecting all subsequent host DNS queries through an attacker-controlled resolver.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <3.11.6
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.