---
id: CVE-2026-92934
title: >-
  vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that
  allows sandbox escape when revisited host-wrapped AggregateError objects are
  caught within a single exception handler traversal
summary: >-
  vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that
  allows sandbox escape when revisited host-wrapped AggregateError objects are
  caught within a single exception handler traversal. Attackers can exploit
  cycle d…
severity: critical
cvss: 9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-693
vendor: patriksimek
product: vm2
affected:
  - vm2 < 3.11.8
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T15:17:00.520'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92934'
references:
  - url: 'https://github.com/patriksimek/vm2/security/advisories/GHSA-x965-fc75-jpqh'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/vm2-before-3.11.8-sandbox-escape-rce-via-aggregateerror
    label: disclosure@vulncheck.com
  - url: 'https://github.com/patriksimek/vm2/security/advisories/GHSA-x965-fc75-jpqh'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-17T14:26:55.310504Z'
ingestedAt: '2026-09-17T14:19:30.982Z'
epss: 0.0074
epssPercentile: 0.53167
---

## Overview

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.