CVE-2026-92938 vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...

CVE-2026-92937 vm2 3.11.6 Remote Code Execution via Promise call/apply

vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when deciding whether to rebuild/sanitise a rejected host...

CVE-2026-92938

vm2 (a Node.js sandboxing library) versions 3.11.3 through 3.11.6 are vulnerable to Remote Code Execution via the node:sqlite module. When the module is permitted (explicitly or via builtin: ['*']), it is wrapped with vm.readonly(), which prevents property assignment but leaves host-authority cal...

CVE-2026-92937

vm2 3.11.6 (a Node.js sandboxing library) is vulnerable to a sandbox escape resulting in remote code execution in the host process. The root cause is an incomplete fix for a prior advisory (GHSA-m283-3h24-438v): the bridge gate at lib/bridge.js:1624 only identity-checks the direct call target, so...

CVE-2026-92936 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...

CVE-2026-92936 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...

EUVD-2026-81586

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...

CVE-2026-92936

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting . Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError (e.g., via eval with malformed source) and then read the error's .stack property; the...

CVE-2026-92936 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...

CVE-2026-92935 vm2 NodeVM Remote Code Execution via Array-Shaped Require

vm2 is a sandbox for running untrusted Node.js code. In versions = 3.11.4 and = 3.11.6, the NodeVM constructor computes hasRealRequireConfig with typeof requireOpts === 'object' && requireOpts !== null, so an array-shaped require value for example require: satisfies the guard that is meant to...

CVE-2026-92935 vm2 NodeVM Remote Code Execution via Array-Shaped Require

vm2 is a sandbox for running untrusted Node.js code. In versions = 3.11.4 and = 3.11.6, the NodeVM constructor computes hasRealRequireConfig with typeof requireOpts === 'object' && requireOpts !== null, so an array-shaped require value for example require: satisfies the guard that is meant to...

CVE-2026-92934 vm2 before 3.11.8 Sandbox Escape RCE via AggregateError

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...

EUVD-2026-81584

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...

CVE-2026-92934 vm2 before 3.11.8 Sandbox Escape RCE via AggregateError

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...

CVE-2026-92935 vm2 NodeVM Remote Code Execution via Array-Shaped Require

vm2 is a sandbox for running untrusted Node.js code. In versions = 3.11.4 and = 3.11.6, the NodeVM constructor computes hasRealRequireConfig with typeof requireOpts === 'object' && requireOpts !== null, so an array-shaped require value for example require: satisfies the guard that is meant to...

CVE-2026-92934

vm2 (a Node.js sandbox library) versions before 3.11.8 contain an incomplete fix for Error.cause sanitization . When a host-wrapped AggregateError object is revisited within a single exception handler traversal in handleException, the cycle detection bypass allows access to unsanitized host proxi...

CVE-2026-92934 vm2 before 3.11.8 Sandbox Escape RCE via AggregateError

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...

CVE-2026-92935

vm2 is a sandbox for running untrusted Node.js code. In versions 3.11.4 through 3.11.6 , a flaw in the NodeVM constructor's guard (typeof requireOpts === 'object' && requireOpts !== null) allows an array-shaped require value (e.g., require: []) to pass, producing a resolver with only NESTING_OVER...

CVE-2026-92933 vm2 before 3.11.8 Information Disclosure via util.getCallSites

vm2 is a sandbox for running untrusted Node.js code. In versions = 22.9 this hands sandboxed code util.getCallSites, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and...

EUVD-2026-81583

vm2 is a sandbox for running untrusted Node.js code. In versions = 22.9 this hands sandboxed code util.getCallSites, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and...