CVE-2026-92937

Name of the Vulnerable Software and Affected Versions vm2 version 3.11.6

Description A sandbox escape allows remote code execution in the host Node.js process. The issue occurs because the bridge gate at lib/bridge.js:1624 only performs identity-checks on the direct call target when deciding whether to sanitize a rejected host Promise value. By registering a rejection handler through Function.prototype.call or .apply indirection, the sanitizer is bypassed, allowing raw host errors to reach the sandbox code. If a host-realm Promise is exposed to the sandbox and rejects with an Error containing a non-primitive own property that references a host object, untrusted code can obtain a proxy to that host object and execute arbitrary commands with host process privileges.

Recommendations Update vm2 to version 3.11.7.