# CVE-2026-92937

vm2 sandbox escape allowing host Node.js remote code execution via crafted Promise.call/apply

- Page: https://www.vulneraibility.com/cve/CVE-2026-92937
- CVSS: 10.0
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 1.03% (percentile 63.9)
- CISA SSVC: exploitation poc, automatable yes, technical impact total (assessed 2026-09-18)
- Weakness: CWE-94
- Also known as: GHSA-647f-g98j-qq25
- Published: 2026-09-17

## Affected versions

- patriksimek vm2: affected >= 3.11.6 and < 3.11.7; fixed in 3.11.7

A version outside these ranges is not a statement that it is unaffected.

## Impact

Sandbox escape yields full RCE in host Node.js process; attacker can run arbitrary commands and access host objects (e.g., spawn child_process).

## Action

Immediate action required

## Recommendation

Upgrade vm2 to 3.11.7 immediately and audit exposed host Promises

## References

- [advisory] https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25
- [advisory] https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.