Detections
Analytics

SCA: security update for vm2 (GHSA-jf8q-945g-9q4c)

high Tenable Self-Hosted Container Security Plugin ID 455125

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the
 sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and
 write traps in lib/bridge.js use a fixed list of known dangerous registered symbols that omits
 nodejs.stream.disturbed and nodejs.stream.errored, which are exposed on host WebStream prototypes on newer
 Node.js releases (validated on Node.js v25.8.0). When the embedder exposes a host WebStream object and the
 host stream/web module to the sandbox, sandbox code can obtain the real host symbols via
 Object.getOwnPropertySymbols(streamWeb.ReadableStream.prototype) and use them as write keys on host stream
 objects, corrupting host-visible stream state — for example making stream.Readable.isDisturbed() return
 false for an already-consumed stream. This can bypass host logic that relies on Node's public stream-state
 helpers to enforce one-shot body consumption, reject errored streams, or decide whether a stream is safe
 to hand to another component. It is not a host code-execution primitive in the reported proof of
 vulnerability. This is an incomplete fix for the earlier nodejs.* symbol filtering issue. Fixed in vm2
 3.11.7. (CVE-2026-92952)

Solution

Update the vm2 library and its related packages to version 3.11.7 or later.

See Also

https://github.com/advisories/GHSA-jf8q-945g-9q4c

Plugin Details

Severity: High

ID: 455125

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 50.56

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-92952

CVSS v3

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.9

Threat Score: 6.3

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/1/2026

Vulnerability Publication Date: 9/17/2026

Reference Information

CVE: CVE-2026-92952

cwe: CWE-669