CVEs classified under CWE-114, newest first.
1 CVERSS
CVE-2026-92939
vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process au…