Critical severity9.0NVD Advisory· Published Sep 17, 2026· Updated Sep 17, 2026
CVE-2026-92934
CVE-2026-92934
Description
vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vm2npm | < 3.11.8 | 3.11.8 |
Affected products
2<3.11.8+ 1 more
- (no CPE)range: <3.11.8
- (no CPE)range: <3.11.8
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-x965-fc75-jpqhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-92934ghsaADVISORY
- github.com/patriksimek/vm2/commit/c8c232530b860cfecf6f94bc8d0d0890aa381460ghsaWEB
- github.com/patriksimek/vm2/releases/tag/v3.11.8ghsaWEB
- github.com/patriksimek/vm2/security/advisories/GHSA-x965-fc75-jpqhnvdWEB
- www.vulncheck.com/advisories/vm2-before-3.11.8-sandbox-escape-rce-via-aggregateerrornvdWEB
News mentions
1- vm2 npm Package: 25 Critical Sandbox Escape Vulnerabilities Disclosed TogetherVypr Intelligence · Sep 18, 2026