CVE-2026-92940: Exposure of Resource to Wrong Sphere in patriksimek vm2
vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent's 'free' event. When an unrelated host HTTPS request releases a pooled connection, the listener receives the live host request options and the host TLSSocket, allowing sandboxed code to read the host's Authorization header and private destination host/port, attach a data listener to the released socket and read subsequent host response bodies in plaintext, and issue attacker-chosen authenticated requests using the stolen credentials. The issue is fixed in 3.11.7.
AI Analysis
Technical Summary
In vm2 versions 3.11.3 through 3.11.6, when a NodeVM is explicitly configured to allow require('https'), the host's https.globalAgent is exposed to sandboxed code. Although the builtin loader wraps host modules in a read-only proxy, method calls like Agent.prototype.on() are forwarded to the underlying host object. This allows sandboxed code to register listeners on the agent's 'free' event, receiving live host request options and the host TLSSocket when a pooled connection is released. Consequently, sandboxed code can read sensitive data such as Authorization headers and private host/port information, attach listeners to the socket to read response bodies in plaintext, and issue authenticated requests with stolen credentials. The issue is resolved in vm2 version 3.11.7.
Potential Impact
Sandboxed code can bypass intended isolation by accessing sensitive HTTPS agent internals of the host process. This leads to exposure of Authorization headers, private destination host and port information, and plaintext reading of host response bodies. Additionally, attackers can perform authenticated requests using stolen credentials, potentially compromising host security and confidentiality.
Mitigation Recommendations
Upgrade vm2 to version 3.11.7 or later, where this vulnerability is fixed. No other mitigations are indicated or required by the vendor advisory.
CVE-2026-92940: Exposure of Resource to Wrong Sphere in patriksimek vm2
Description
vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent's 'free' event. When an unrelated host HTTPS request releases a pooled connection, the listener receives the live host request options and the host TLSSocket, allowing sandboxed code to read the host's Authorization header and private destination host/port, attach a data listener to the released socket and read subsequent host response bodies in plaintext, and issue attacker-chosen authenticated requests using the stolen credentials. The issue is fixed in 3.11.7.
CVSS v4.0
Score 10.0critical
Affected software
patriksimek
vm2
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In vm2 versions 3.11.3 through 3.11.6, when a NodeVM is explicitly configured to allow require('https'), the host's https.globalAgent is exposed to sandboxed code. Although the builtin loader wraps host modules in a read-only proxy, method calls like Agent.prototype.on() are forwarded to the underlying host object. This allows sandboxed code to register listeners on the agent's 'free' event, receiving live host request options and the host TLSSocket when a pooled connection is released. Consequently, sandboxed code can read sensitive data such as Authorization headers and private host/port information, attach listeners to the socket to read response bodies in plaintext, and issue authenticated requests with stolen credentials. The issue is resolved in vm2 version 3.11.7.
Potential Impact
Sandboxed code can bypass intended isolation by accessing sensitive HTTPS agent internals of the host process. This leads to exposure of Authorization headers, private destination host and port information, and plaintext reading of host response bodies. Additionally, attackers can perform authenticated requests using stolen credentials, potentially compromising host security and confidentiality.
Mitigation Recommendations
Upgrade vm2 to version 3.11.7 or later, where this vulnerability is fixed. No other mitigations are indicated or required by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-17T12:42:34.828Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aac405055bf5e2cf5cb2381
Added to database: 09/17/2026, 19:32:32 UTC
Last enriched: 09/17/2026, 19:46:46 UTC
Last updated: 09/18/2026, 02:16:09 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.