CVE-2026-92934CWE-693

CVE-2026-92934

Critical · published September 17, 2026

CVSS v3.1
9.0
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox.

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
9.5 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00762 · 54.9th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2026-09-17T18:17Z
References (3)
https://github.com/patriksimek/vm2/security/advisories/GHSA-x965-fc75-jpqh · [email protected]https://www.vulncheck.com/advisories/vm2-before-3.11.8-sandbox-escape-rce-via-aggregateerror · [email protected]https://github.com/patriksimek/vm2/security/advisories/GHSA-x965-fc75-jpqh · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 1%
    epss
  • 17 SEP 13:46Z
    vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
    cvelistv5