External risk intelligence

vm2 NodeVM Host Agent Information Disclosure

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-92940

This vulnerability exists in a JavaScript sandbox library (vm2) used as a dependency within applications. It is not an internet-facing service or appliance itself, but a build-time or runtime component meant for isolating untrusted code, typically requiring a specific, developer-defined configuration to even manifest.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the vm2 JavaScript sandbox library that could expose sensitive host information, such as authentication credentials and request details, to sandboxed code under specific configurations. While the library is designed to isolate untrusted code, an improper handling of the `https.globalAgent` could allow malicious or compromised code within the sandbox to intercept and misuse network traffic and credentials from the host environment. The main concern is confirming relevance and exposure due to the specific configuration required for this vulnerability to be exploitable.

Sensitive host data exposed to sandbox.
Impacts applications using this sandbox library.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by exploiting a misconfiguration in the `vm2` sandbox library, specifically when it's set up to allow access to the `https` module. This exposure allows sandboxed code to intercept sensitive information from legitimate host HTTPS requests. The compromised data can then be used to issue authenticated requests on behalf of the host, potentially leading to unauthorized actions and data breaches.

Entry Condition: Sandbox configured to allow `https` module access.
Trigger Point: Host initiates an HTTPS request, releasing a pooled connection.
Resulting Risk: Sensitive host credentials and data exposure.

Live Threat

Current exploitation, exposure, and threat context

When Node.js applications use specific configurations within the vm2 library to allow sandboxed code to access network-related host modules, sensitive information from outgoing HTTPS requests could be exposed. This includes potentially reading request headers, destination details, and even response bodies.

Host HTTPS request details could be read.
Sandbox code may listen to agent events.
Sensitive headers and response data may leak.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vm2 library's vulnerability requires explicit configuration to expose sensitive host information, suggesting that development or platform teams managing Node.js environments are most likely to be impacted. The immediate first step is to identify all instances of the affected library, determine their reachability and criticality within the business context, and assign ownership for remediation planning.

Ownership: Development or Platform Teams.
Verify first: Identify and audit vm2 usage.
Action: Plan and execute upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is vm2 and why is it used?

vm2 is a JavaScript library for Node.js designed to run untrusted code in a secure, isolated environment called a sandbox. Developers use it to safely execute code from external sources by limiting its ability to access sensitive system resources or host information. It essentially acts as a container, aiming to prevent guest code from breaking out and interacting with the main application process.

What does CWE-668 mean for CVE-2026-92940?

CWE-668, or Exposure of Resource to Wrong Sphere, describes the weakness where a resource is accessible from a context that should not be allowed. In this vulnerability, the sandbox fails to properly restrict access to the host's network agent. This allows code running inside the isolated sandbox to reach into the host environment's HTTPS communication channel, gaining access to data and credentials it should never have been able to see.

How is this vulnerability triggered?

The issue only occurs if the sandbox is explicitly configured to allow the 'https' module. Without this specific configuration, the code inside the sandbox cannot interact with the host's network agent. If allowed, the vulnerability triggers when the host performs an HTTPS request and returns a connection to the pool, at which point the sandboxed code can intercept host-specific request details and responses.

Is my application at risk?

Halo Surface Signal indicates that this vulnerability is unlikely to affect public-facing infrastructure directly because vm2 is an internal code dependency, not a standalone service. The primary risk exists where developers have explicitly enabled network module access within a sandbox. You should focus on identifying applications where you are intentionally running untrusted code that requires these specific host network permissions.

How do I address this CVE?

Your first step is to perform an audit of your codebase to locate all instances of the vm2 library. Once identified, evaluate whether the sandbox configuration requires 'https' module access. If it does, you should prioritize upgrading vm2 to version 3.11.7 or later, which resolves the flaw in how the host agent is handled.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.