CVE-2026-92944
Description
A flaw was found in vm2. An attacker capable of running code within the sandbox environment can bypass security wrappers by supplying a crafted asynchronous Promise object. This flaw allows the attacker to escape the sandbox and access host system objects, leading to arbitrary code execution on the underlying host.
Déclaration
This vulnerability is rated as having an Important severity because escaping the sandbox breaks the primary security boundary of the environment, granting an attacker the ability to execute code within the context of the host process. In Red Hat environments such as Red Hat Developer Hub and Ansible Automation Platform, vm2 is embedded within backend container services, meaning exposure depends on workloads evaluating untrusted user-supplied scripts. A successful compromise allows arbitrary operations under the permissions of the hosting service.
Mesure d'atténuation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Détails du score du système commun d'évaluation des vulnérabilités (CVSS)
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
Les mesures et les scores CVSS suivants sont préliminaires et sujets à révision.
Répartition des scores CVSS v3
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Score de base | 9.8 | N/A | 9.8 |
| Vecteur d'attaque | Network | N/A | Network |
| Complexité de l'attaque | Low | N/A | Low |
| Privilèges requis | None | N/A | None |
| Interaction avec l'utilisateur | None | N/A | None |
| Champ d'application | Unchanged | N/A | Unchanged |
| Confidentialité | High | N/A | High |
| Impact sur l'intégrité | High | N/A | High |
| Impact sur la disponibilité | High | N/A | High |
Vecteur
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Comprendre la Défaillance (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Questions fréquemment posées
Not sure what something means? Check out our Security Glossary.
Vous souhaitez recevoir des notifications d'errata ? Signez ici.
