CVE-2026-92934
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
vm2 3.11.6 (this fork's latest release) contains an incomplete-fix bypass of the Error.cause host-reference sanitization added in GHSA-m283-3h24-438v (commit 7e3faaf). Sandbox code that catches a host-wrapped AggregateError which is *revisited within a single handleException traversal* (self-cycle, mutual-cycle, or the same host aggregate referenced twice in errors[]) receives a live, unsanitized…
- No known exploitation
- Severity
- Critical, CVSS 9.5 (v4.0)
- EPSS
- 0.76% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vm2 (npm) <= 3.11.7, fixed in 3.11.8 · GHSA-x965-fc75-jpqh