CVE-2026-92934: vm2 Package Vulnerability Leading to Host RCE via AggregateError Bypass
Summary
CVE-2026-92934: vm2 3.11.6 (this fork's latest release) contains an incomplete-fix bypass of the Error.cause host-reference sanitization added in GHSA-m283-3h24-438v (commit 7e3faaf). Affects vm2 versions < 3.11.8. Fixed in 3.11.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for executing untrusted code securely. It allows developers to run JavaScript code in a controlled environment, preventing access to the host system. However, vulnerabilities in its error handling mechanisms can lead to security risks, such as remote code execution (RCE). This specific vulnerability affects versions up to 3.11.7, where an incomplete fix allows attackers to escape the sandbox under certain conditions.
Vulnerability Detail
The vulnerability arises from an incomplete fix in the vm2 package, specifically in the handling of AggregateError objects. When an AggregateError is revisited during exception handling, the system returns a live, unsanitized host proxy instead of a sanitized version. This flaw allows attackers to execute arbitrary code on the host system, leading to full RCE. The vulnerability is particularly dangerous as it can expose sensitive information such as environment variables and process IDs.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.8
This is the first release that contains the fix.
npm install vm2@3.11.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using host-wrapped AggregateError objects in your sandboxed code. Instead, ensure that error handling does not involve revisiting the same error objects multiple times within a single traversal.
Conclusion
The vm2 package vulnerability CVE-2026-92934 poses a significant risk due to its potential for remote code execution through improper handling of AggregateError objects. It is crucial for developers using this package to update to the patched version and consider implementing workarounds to mitigate risks until they can upgrade.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 9.0, indicating a critical level of risk.
Versions of vm2 up to and including 3.11.7 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include remote code execution on the host system and exposure of sensitive information such as environment variables.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
