CVE-2026-92934

CVSS 9.5 (critical) · published 2026-09-17

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox.

Weakness: CWE-693

Source: NVD CVE-2026-92934

References

• https://github.com/patriksimek/vm2/security/advisories/GHSA-x965-fc75-jpqh
• https://www.vulncheck.com/advisories/vm2-before-3.11.8-sandbox-escape-rce-via-aggregateerror
• https://github.com/patriksimek/vm2/security/advisories/GHSA-x965-fc75-jpqh

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.