THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-92933 (MEDIUM 5.8) — vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an alias of host `util`) is

[NVD] CVE-2026-92933 (MEDIUM 5.8) — vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an alias of host `util`) is

mednvdPublished 2026-09-17

CVE-2026-92933 CVSS: 5.8 MEDIUM Published: 2026-09-17T14:17:57.337

vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an alias of host `util`) is exposed through the generic builtin loader. On Node.

Indicators of compromise

CVE-2026-92933cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-92933