CVE-2026-92934
vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
CVSS Score
9.0
EPSS Score
0.0%
EPSS Percentile
0th
vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox.
| CWE | CWE-693 |
| Vendor | patriksimek |
| Product | vm2 |
| Published | Sep 17, 2026 |
| Last Updated | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for patriksimek vm2
Be the first to know when new critical vulnerabilities affecting patriksimek vm2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
patriksimek / vm2
0 < 3.11.8
References
Credits
🔍 manus-use 🔍 maru1009