---
id: CVE-2026-92949
title: >-
  vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to
  accessor properties on frozen objects, allowing sandboxed scripts to bypass
  vm.freeze() and vm.readonly() protections
summary: >-
  vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to
  accessor properties on frozen objects, allowing sandboxed scripts to bypass
  vm.freeze() and vm.readonly() protections. Attackers can use
  Object.getOwnPropertyDescr…
severity: medium
cvss: 4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N'
cwe:
  - CWE-471
  - CWE-807
vendor: patriksimek
product: vm2
affected:
  - vm2 >= 3.9.6 < 3.11.7
published: '2026-09-17'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T18:17:15.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92949'
references:
  - url: 'https://github.com/patriksimek/vm2/security/advisories/GHSA-633r-hq9m-c4ff'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/vm2-3.9.6-before-3.11.7-sandbox-bypass-via-accessor-descriptor
    label: disclosure@vulncheck.com
  - url: 'https://github.com/patriksimek/vm2/security/advisories/GHSA-633r-hq9m-c4ff'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92949.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-92949'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-92949'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92949'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536060'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - exploit-available
epss: 0.00319
epssPercentile: 0.22091
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T17:14:06.865069Z'
ingestedAt: '2026-09-17T14:19:30.987Z'
---

## Overview

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to extract and invoke host object setters directly, mutating properties the embedder explicitly marked read-only.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Developer Hub, Self-service automation portal 2 · no fix planned: Red Hat Developer Hub, Self-service automation portal 2 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92949.json)