NPM: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

🗓️ 05 Oct 2026 22:38:04Reported by PatchstackType

patchstack🔗 patchstack.com👁 3 Views

vm2 sandbox escape to host RCE via AggregateError bypassing Error sanitization.

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	The vulnerability of the NPM packet manager’s vm2 library, related to a flaw in the data protection mechanism, allows attackers to execute arbitrary code.	21 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-92934	17 Sep 202615:20	–	circl
CVE	CVE-2026-92934	17 Sep 202613:46	–	cve
Cvelist	CVE-2026-92934 vm2 before 3.11.8 Sandbox Escape RCE via AggregateError	17 Sep 202613:46	–	cvelist
EUVD	EUVD-2026-81584	5 Oct 202622:38	–	euvd
Github Security Blog	Duplicate Advisory: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit	17 Sep 202615:32	–	github
Github Security Blog	vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit	5 Oct 202622:38	–	github
NVD	CVE-2026-92934	17 Sep 202614:17	–	nvd
OSV	GHSA-X965-FC75-JPQH vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit	5 Oct 202622:38	–	osv
Positive Technologies	PT-2026-94306	25 Aug 202600:00	–	ptsecurity

Vulners

Node

npm vm2Range≤3.11.7

Source	Link
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-x965-fc75-jpqh
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-92934
github	www.github.com/patriksimek/vm2/commit/c8c232530b860cfecf6f94bc8d0d0890aa381460
github	www.github.com/patriksimek/vm2/releases/tag/v3.11.8
vulncheck	www.vulncheck.com/advisories/vm2-before-3.11.8-sandbox-escape-rce-via-aggregateerror
github	www.github.com/advisories/GHSA-x965-fc75-jpqh

05 Oct 2026 22:38Current

6Medium risk

Vulners AI Score6

CVSS 3.19

CVSS 49.5

EPSS0.00762

SSVC

NPM vm2 sandbox escape RCE AggregateError Error sanitization