CVE-2026-92952: vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
vm2 current head (v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92) still exposes registered Node.js internal symbols from host WebStream prototypes to sandbox code.
The prior nodejs.* symbol hardening blocks Symbol.for('nodejs.<name>') at the source, but the extraction filters and bridge write traps still enumerate a fixed set of known registered symbols. On Node.js v25.8.0, stream/web exposes two additional registered symbols:
nodejs.stream.disturbednodejs.stream.errored
Sandbox code can extract those real host symbols with Object.getOwnPropertySymbols(streamWeb.ReadableStream.prototype) and then use them as write keys on host objects. On a real host ReadableStream, an attacker can make stream.Readable.isDisturbed(stream) return false after the stream has already been read.
References
- github.com/advisories/GHSA-jf8q-945g-9q4c
- github.com/patriksimek/vm2/commit/a45444d5abbdfa59055528f584df5f21cc7c42da
- github.com/patriksimek/vm2/releases/tag/v3.11.7
- github.com/patriksimek/vm2/security/advisories/GHSA-jf8q-945g-9q4c
- nvd.nist.gov/vuln/detail/CVE-2026-92952
- www.vulncheck.com/advisories/vm2-3.11.4-through-3.11.6-sandbox-symbol-filtering-bypass
Code Behaviors & Features
Detect and mitigate CVE-2026-92952 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →