The vulnerability CVE-2026-92960 affects patriksimek vm2 versions prior to 3.11.6. When vm2 is configured with builtin: ['*'], it does not properly restrict access to the os and dns built-in modules. This allows sandboxed code to access sensitive information about the host process identity and network topology. Furthermore, attackers can invoke dns.setServers() to globally hijack the host process DNS resolver, causing all subsequent DNS queries from the host to be redirected through an attacker-controlled DNS server. This represents a critical security risk with a CVSS 4.0 base score of 10.0.

Exploitation of this vulnerability allows an attacker to gain unauthorized access to sensitive host information such as process identity and network topology. Additionally, the attacker can hijack the host's DNS resolver globally, redirecting all DNS queries through a malicious DNS server. This can lead to further attacks such as DNS spoofing, interception of network traffic, and potential compromise of the host environment.

A fix is available in patriksimek vm2 version 3.11.6 and later. Users should upgrade to version 3.11.6 or newer to remediate this vulnerability. Until upgraded, avoid using the builtin: ['*'] configuration to restrict access to sensitive built-in modules. Patch status is confirmed by the affectedVersions field indicating versions before 3.11.6 are vulnerable.