vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when
    revisited host-wrapped AggregateError objects are caught within a single exception handler traversal.
    Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies
    embedded in the errors array, enabling full remote code execution and process information disclosure from
    the sandbox. (CVE-2026-92934)

ID	Name	Product	Family	Type	Severity
473587	Echo: vm2: security update to 3.11.8	Tenable Cloud Security	Echo Local Security Checks	Local	critical
473587	Echo: vm2: security update to 3.11.8	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
473017	SCA: security update for vm2 (GHSA-x965-fc75-jpqh)	Tenable Cloud Security	SCA Checks	Local	critical
473017	SCA: security update for vm2 (GHSA-x965-fc75-jpqh)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-92934

critical

Tenable Plugins

critical

critical

critical

critical