Multiple CVE's - vm2 sandbox escapes and host state tampering enable RCE and credential interception - Upwind | Cloud & AI Security for the Realtime Era

Security Feed

See the latest insights and analysis from our MDR team.

CVE-2026-92960, CVE-2026-92956, CVE-2026-92955, CVE-2026-92953, CVE-2026-92946, CVE-2026-92941, CVE-2026-92940, CVE-2026-92937

By Roy Kalfon |

17 September 2026

Multiple CVE’s – vm2 sandbox escapes and host state tampering enable RCE and credential interception

vm2 flaws let sandboxed code escape or mutate host state: Node.js 26 new VM() escape (3.10.1–3.11.6, fix 3.11.7), NodeVM escape `