CVE-2026-92949 | patriksimek vm2 3.9.6/3.11.6 Frozen Object Access Object.getOwnPropertyDescriptor/__lookupSetter__ access control

A vulnerability has been found in patriksimek vm2 3.9.6/3.11.6 and classified as problematic. This impacts the function Object.getOwnPropertyDescriptor/__lookupSetter__ of the component Frozen Object Access. Performing a manipulation results in improper access controls.

This vulnerability is reported as CVE-2026-92949. The attack is possible to be carried out remotely. No exploit exists.

The affected component should be upgraded.VulDB Recent EntriesRead More