Echo: vm2: security update to 3.11.7

critical Tenable Cloud Security Plugin ID 472229

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto
builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports
still execute with host-process authority. Sandboxed JavaScript can therefore call crypto.setEngine() with
a filesystem path to an attacker-supplied native library (for example, one bundled in an untrusted plugin
package already written to disk); OpenSSL asks the operating-system dynamic loader to load the file, and
the library's constructor executes native code in the host process before engine-symbol validation rejects
it. Exploitation requires only the crypto builtin and does not require fs, process, module, child_process,
worker_threads, vm, or inspector access, resulting in a sandbox escape and arbitrary native code
execution. Fixed in 3.11.7. (CVE-2026-92939)

Solution

Update the vm2 library and its related packages to version 3.11.7 or later.

Plugin Details

Severity: Critical

ID: 472229

Version: Revision 1.1

Type: Local

Family: Echo Local Security Checks

Published: 10/3/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.31

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-92939

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Temporal Score: 8.6

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.4

Threat Score: 7.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/3/2026

Vulnerability Publication Date: 9/17/2026

Reference Information

CVE: CVE-2026-92939

Detections

Analytics