Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck

CVE-2026-92934vm2 before 3.11.8 Sandbox Escape RCE via AggregateError

Critical 9.0

In plain English

A critical-severity security flaw in vm2 from patriksimek. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)0.8%top 44.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	vm2	3.11.8	GHSA-x965-fc75-jpqh

Affected products (as reported)

Vendor	Product	Versions
patriksimek	vm2	0 – before 3.11.8

Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-x965-fc75-jpqh) vendor-advisory
VulnCheck Advisory: vm2 before 3.11.8 Sandbox Escape RCE via AggregateError third-party-advisory