CVE-2026-92940

{
  "etk_id": "ETK-2026-252",
  "cve_id": "CVE-2026-92940",
  "display_id": "CVE-2026-92940",
  "ghsa_id": "GHSA-5843-9mh5-hhgw",
  "euvd_id": "EUVD-2026-81590",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Shared HTTPS agent sandbox isolation flaw in vm2",
  "summary": "vm2 versions 3.11.3 through 3.11.6 can expose host HTTPS request state to code running in a NodeVM. An attacker able to run sandboxed code with the https builtin enabled may access host traffic or credentials and use them for authenticated actions when the host relies on the default HTTPS agent.",
  "mitigation": "Upgrade vm2 to version 3.11.7 or later. Until upgraded, do not allow https in untrusted NodeVM code and use dedicated HTTPS agents for sensitive host requests.",
  "vendor": "npm",
  "product": "npm:vm2",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.11.3, <= 3.11.6"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.11.7"
      ],
      "package_name": "vm2",
      "purl": "pkg:npm/vm2"
    }
  ],
  "cwes": null,
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
  "epss_score": 0.0047,
  "epss_percentile": 0.397,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.0856945,
  "t0_at": "2026-09-17T13:46:04.218000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-01T15:38:26+00:00",
      "days": 14.078029884259259,
      "is_lower_bound": false,
      "measured_at": "2026-09-17T13:46:04.218000+00:00",
      "url": "https://github.com/advisories/GHSA-h85j-hv3c-qfgq"
    },
    "trigger_signal": {
      "at": "2026-09-17T13:46:04.218000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-17T13:46:04.218000+00:00",
      "url": "https://github.com/advisories/GHSA-h85j-hv3c-qfgq"
    }
  }
}