https://vulnerability.circl.lu/sightings/feed 2026-10-07T23:54:13.534245+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/4a93edb5-6ca1-48ac-8d9e-3b96dae0fc95/export 2026-10-07T23:54:13.561908+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "4a93edb5-6ca1-48ac-8d9e-3b96dae0fc95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92937", "type": "seen", "source": "https://gist.github.com/alon710/8dec9e229956e0595f921cdad9386c9d", "content": "# CVE-2026-92937: CVE-2026-92937: Sandbox Escape leading to Remote Code Execution via Promise Indirection in vm2\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-92937\n\n## Summary\nCVE-2026-92937 is a critical sandbox escape vulnerability in the `vm2` Node.js library. Due to a logical failure in checking direct invocation targets inside the Proxy bridge, an attacker can register Promise callbacks using `Function.prototype.call` or `Function.prototype.apply` indirection. This bypasses the error sanitization wrappers, delivering raw host error objects directly to sandboxed callbacks and allowing the attacker to escape the sandbox and execute arbitrary shell commands on the host.\n\n## TL;DR\nA critical bypass in the vm2 sandbox proxy lets untrusted code use Function call/apply indirection to bypass Promise rejection sanitizers, leading to remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94, CWE-693\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 10.0 (Critical)\n- **EPSS Score**: 0.01033 (1.03%)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **Patch Version**: 3.11.7\n\n## Affected Systems\n\n- Node.js applications running vm2 <= 3.11.6\n- **vm2**: <= 3.11.6 (Fixed in: `3.11.7`)\n\n## Mitigation\n\n- Update vm2 to version 3.11.7 or later\n- Migrate away from vm2 to secure sandboxes like WebAssembly or isolated hypervisors\n\n**Remediation Steps:**\n1. Identify all occurrences of vm2 in dependencies\n2. Update package.json to require vm2 version 3.11.7\n3. Perform dependency audits to ensure older versions are not bundled\n\n## References\n\n- [Official GitHub Advisory](https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25)\n- [NVD Official CVE Page](https://nvd.nist.gov/vuln/detail/CVE-2026-92937)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-92937)\n- [Fix Commit](https://github.com/patriksimek/vm2/commit/315786904c416be68ff2517b86fb9d71fa6761db)\n- [Official Version Release (v3.11.7)](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-92937) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-02T07:30:28.000000Z"} 2026-10-02T07:30:28+00:00 https://vulnerability.circl.lu/sighting/ae960459-43e0-4c46-95dd-5dd45fc67b90/export 2026-10-07T23:54:13.563905+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "ae960459-43e0-4c46-95dd-5dd45fc67b90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-92937", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-647f-g98j-qq25", "content": "", "creation_timestamp": "2026-10-01T15:32:10.000000Z"} 2026-10-01T15:32:10+00:00 https://vulnerability.circl.lu/sighting/00687559-bfad-4dec-93d8-390228f87aef/export 2026-10-07T23:54:13.564885+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "00687559-bfad-4dec-93d8-390228f87aef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92937", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117287817060203283", "content": "ICYMI: 19 sev:CRIT CVEs in Node VM2, which is supposed to be a sandbox, but apparently it's built like the AI \"sandboxes.\"\nhttps://www.cve.org/CVERecord?id=CVE-2026-92934https://www.cve.org/CVERecord?id=CVE-2026-92935https://www.cve.org/CVERecord?id=CVE-2026-92937https://www.cve.org/CVERecord?id=CVE-2026-92938https://www.cve.org/CVERecord?id=CVE-2026-92939https://www.cve.org/CVERecord?id=CVE-2026-92940https://www.cve.org/CVERecord?id=CVE-2026-92941https://www.cve.org/CVERecord?id=CVE-2026-92944https://www.cve.org/CVERecord?id=CVE-2026-92946https://www.cve.org/CVERecord?id=CVE-2026-92947https://www.cve.org/CVERecord?id=CVE-2026-92948https://www.cve.org/CVERecord?id=CVE-2026-92950https://www.cve.org/CVERecord?id=CVE-2026-92951https://www.cve.org/CVERecord?id=CVE-2026-92953https://www.cve.org/CVERecord?id=CVE-2026-92954https://www.cve.org/CVERecord?id=CVE-2026-92955https://www.cve.org/CVERecord?id=CVE-2026-92956https://www.cve.org/CVERecord?id=CVE-2026-92957https://www.cve.org/CVERecord?id=CVE-2026-92960", "creation_timestamp": "2026-09-17T18:34:21.294741Z"} 2026-09-17T18:34:21.294741+00:00 https://vulnerability.circl.lu/sighting/ed0add66-7e7d-4ac0-a402-58a0bf0e08a4/export 2026-10-07T23:54:13.564980+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ed0add66-7e7d-4ac0-a402-58a0bf0e08a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92937", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvpzzgdmdy2w", "content": "\ud83d\udea8 CVE-2026-92937 \u2014 CVSS 10 CRITICAL\n\nvm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92937\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:08:32.655693Z"} 2026-09-17T16:08:32.655693+00:00 https://vulnerability.circl.lu/sighting/fd72283f-d08b-4eb9-9d9f-0a751dbed7ec/export 2026-10-07T23:54:13.565053+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "fd72283f-d08b-4eb9-9d9f-0a751dbed7ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92937", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvpzkdgdtk2t", "content": "CVE-2026-92937 - vm2\nThe vm2 sandbox library version 3.11.6 can be tricked into exposing the underlying Node.js process, allowing untrusted code to execute commands on the server. This occurs when a rejected\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T16:00:07.291284Z"} 2026-09-17T16:00:07.291284+00:00