Detections
Analytics

Echo: vm2: security update to 3.11.7

critical Tenable Self-Hosted Container Security Plugin ID 472231

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process.
 The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only
 the direct call target when deciding whether to rebuild/sanitise a rejected host Promise value.
 Registering the rejection handler through Function.prototype.call or .apply indirection (e.g.,
 p.then.call(p, undefined, cb)) makes the intercepted target host Function.prototype.call, so the sanitiser
 never runs and the raw host error reaches sandbox code with its own properties intact. If an embedder
 exposes a host-realm Promise to the sandbox (an async host function bridged via the sandbox option, or a
 NodeVM external module's async method) and that Promise rejects with an Error carrying a non-primitive own
 property referencing a host object (for example err.detail = process), untrusted code in the sandbox
 obtains a fully functional proxy to that host object and can execute arbitrary commands with the
 privileges of the host process (e.g., e.detail.mainModule.require('child_process').execSync(...)). The
 direct p.then(undefined, cb), bind, and Reflect.apply forms are correctly sanitised. Fixed in vm2 3.11.7.
 (CVE-2026-92937)

Solution

Update the vm2 library and its related packages to version 3.11.7 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-92937

Plugin Details

Severity: Critical

ID: 472231

Version: Revision 1.1

Type: Local

Published: 10/3/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.31

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-92937

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 10

Threat Score: 9.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/3/2026

Vulnerability Publication Date: 9/17/2026

Reference Information

CVE: CVE-2026-92937