CVE-2026-92934
Last modified
CVE-2026-92934 is a critical-severity vulnerability rated 9/10 on the CVSS scale. vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox..
Description
vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-92934?
How severe is CVE-2026-92934?
How do I fix CVE-2026-92934?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92921admin3 through 3.0.0 stores account passwords using single-r…4.9
- CVE-2026-92925A flaw was found in Redis community. The cluster bus packet …7.1
- CVE-2026-92926A vulnerability has been found in code-projects Matrimonial …7.3
- CVE-2026-92927A vulnerability was found in SourceCodester Drug Recommendat…5.3
- CVE-2026-92932In the MISP sachertortephp library, the Xml::build() static …5.1
- CVE-2026-92933vm2 is a sandbox for running untrusted Node.js code. In vers…5.8
- CVE-2026-92935vm2 is a sandbox for running untrusted Node.js code. In vers…9
- CVE-2026-92936vm2 versions 3.11.0 through 3.11.6 leak absolute host filesy…5.8
- CVE-2026-92937vm2 3.11.6 is vulnerable to a sandbox escape leading to remo…10
- CVE-2026-92938vm2 versions 3.11.3 through 3.11.6 expose Node.js's host nod…9.9
- CVE-2026-92939vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto mo…9.9
- CVE-2026-9294A vulnerability was identified in Edimax BR-6428NS 1.10. The…8.8
Are you affected by CVE-2026-92934?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST