CVE-2026-92937 patriksimek CVE debrief

Who should care

Defenders responsible for systems using vm2 3.11.6, especially those with untrusted code execution contexts, should assess exposure and prioritize upgrading to vm2 3.11.7. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure and implement necessary mitigations.

Why it matters

CVE-2026-92937 is a critical vulnerability in vm2 3.11.6 that allows for remote code execution via a sandbox escape. Defenders should prioritize verifying exposure and upgrading to vm2 3.11.7, especially in systems with untrusted code execution contexts. The vulnerability's impact is significant due to its potential for executing arbitrary commands with host process privileges and exposing host objects to untrusted code.

• Potential for remote code execution with host process privileges
• Exposure of host objects to untrusted sandbox code
• Bypass of existing sanitization mechanisms through indirect function calls
• Need for verification of affected systems and inventory checks

Technical summary

The vm2 3.11.6 version is vulnerable to a sandbox escape, allowing for remote code execution in the host Node.js process. This is due to an incomplete fix for GHSA-m283-3h24-438v, where the bridge gate at lib/bridge.js:1624 only checks the direct call target when deciding whether to rebuild/sanitize a rejected host Promise value. The fix in vm2 3.11.7 addresses the issue by properly sanitizing rejected host Promise values, preventing the bypass of existing sanitization mechanisms through indirect function calls. This vulnerability impacts systems using vm2 3.11.6, especially those with untrusted code execution contexts.

Defensive priority

Defenders should prioritize verifying exposure to vm2 3.11.6 and upgrading to 3.11.7, focusing on systems with untrusted code execution contexts.

Recommended defensive actions

• Verify vm2 version and upgrade to 3.11.7 if necessary
• Review systems for exposure, especially those executing untrusted code
• Implement compensating controls for monitoring and exception tracking
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE and NVD records indicate a critical vulnerability in vm2 3.11.6, allowing for remote code execution via a sandbox escape. The fix in vm2 3.11.7 addresses the issue by properly sanitizing rejected host Promise values.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.