https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:54:13 +0000 https://vulnerability.circl.lu/sighting/4a93edb5-6ca1-48ac-8d9e-3b96dae0fc95/export {"uuid": "4a93edb5-6ca1-48ac-8d9e-3b96dae0fc95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92937", "type": "seen", "source": "https://gist.github.com/alon710/8dec9e229956e0595f921cdad9386c9d", "content": "# CVE-2026-92937: CVE-2026-92937: Sandbox Escape leading to Remote Code Execution via Promise Indirection in vm2\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-92937\n\n## Summary\nCVE-2026-92937 is a critical sandbox escape vulnerability in the `vm2` Node.js library. Due to a logical failure in checking direct invocation targets inside the Proxy bridge, an attacker can register Promise callbacks using `Function.prototype.call` or `Function.prototype.apply` indirection. This bypasses the error sanitization wrappers, delivering raw host error objects directly to sandboxed callbacks and allowing the attacker to escape the sandbox and execute arbitrary shell commands on the host.\n\n## TL;DR\nA critical bypass in the vm2 sandbox proxy lets untrusted code use Function call/apply indirection to bypass Promise rejection sanitizers, leading to remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94, CWE-693\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 10.0 (Critical)\n- **EPSS Score**: 0.01033 (1.03%)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **Patch Version**: 3.11.7\n\n## Affected Systems\n\n- Node.js applications running vm2 <= 3.11.6\n- **vm2**: <= 3.11.6 (Fixed in: `3.11.7`)\n\n## Mitigation\n\n- Update vm2 to version 3.11.7 or later\n- Migrate away from vm2 to secure sandboxes like WebAssembly or isolated hypervisors\n\n**Remediation Steps:**\n1. Identify all occurrences of vm2 in dependencies\n2. Update package.json to require vm2 version 3.11.7\n3. Perform dependency audits to ensure older versions are not bundled\n\n## References\n\n- [Official GitHub Advisory](https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25)\n- [NVD Official CVE Page](https://nvd.nist.gov/vuln/detail/CVE-2026-92937)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-92937)\n- [Fix Commit](https://github.com/patriksimek/vm2/commit/315786904c416be68ff2517b86fb9d71fa6761db)\n- [Official Version Release (v3.11.7)](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-92937) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-02T07:30:28.000000Z"} {"uuid": "4a93edb5-6ca1-48ac-8d9e-3b96dae0fc95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92937", "type": "seen", "source": "https://gist.github.com/alon710/8dec9e229956e0595f921cdad9386c9d", "content": "# CVE-2026-92937: CVE-2026-92937: Sandbox Escape leading to Remote Code Execution via Promise Indirection in vm2\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-92937\n\n## Summary\nCVE-2026-92937 is a critical sandbox escape vulnerability in the `vm2` Node.js library. Due to a logical failure in checking direct invocation targets inside the Proxy bridge, an attacker can register Promise callbacks using `Function.prototype.call` or `Function.prototype.apply` indirection. This bypasses the error sanitization wrappers, delivering raw host error objects directly to sandboxed callbacks and allowing the attacker to escape the sandbox and execute arbitrary shell commands on the host.\n\n## TL;DR\nA critical bypass in the vm2 sandbox proxy lets untrusted code use Function call/apply indirection to bypass Promise rejection sanitizers, leading to remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94, CWE-693\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 10.0 (Critical)\n- **EPSS Score**: 0.01033 (1.03%)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **Patch Version**: 3.11.7\n\n## Affected Systems\n\n- Node.js applications running vm2 <= 3.11.6\n- **vm2**: <= 3.11.6 (Fixed in: `3.11.7`)\n\n## Mitigation\n\n- Update vm2 to version 3.11.7 or later\n- Migrate away from vm2 to secure sandboxes like WebAssembly or isolated hypervisors\n\n**Remediation Steps:**\n1. Identify all occurrences of vm2 in dependencies\n2. Update package.json to require vm2 version 3.11.7\n3. Perform dependency audits to ensure older versions are not bundled\n\n## References\n\n- [Official GitHub Advisory](https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25)\n- [NVD Official CVE Page](https://nvd.nist.gov/vuln/detail/CVE-2026-92937)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-92937)\n- [Fix Commit](https://github.com/patriksimek/vm2/commit/315786904c416be68ff2517b86fb9d71fa6761db)\n- [Official Version Release (v3.11.7)](https://github.com/patriksimek/vm2/releases/tag/v3.11.7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-92937) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-02T07:30:28.000000Z"} https://vulnerability.circl.lu/sighting/4a93edb5-6ca1-48ac-8d9e-3b96dae0fc95/export Fri, 02 Oct 2026 07:30:28 +0000 https://vulnerability.circl.lu/sighting/ae960459-43e0-4c46-95dd-5dd45fc67b90/export {"uuid": "ae960459-43e0-4c46-95dd-5dd45fc67b90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-92937", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-647f-g98j-qq25", "content": "", "creation_timestamp": "2026-10-01T15:32:10.000000Z"} {"uuid": "ae960459-43e0-4c46-95dd-5dd45fc67b90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-92937", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-647f-g98j-qq25", "content": "", "creation_timestamp": "2026-10-01T15:32:10.000000Z"} https://vulnerability.circl.lu/sighting/ae960459-43e0-4c46-95dd-5dd45fc67b90/export Thu, 01 Oct 2026 15:32:10 +0000 https://vulnerability.circl.lu/sighting/00687559-bfad-4dec-93d8-390228f87aef/export {"uuid": "00687559-bfad-4dec-93d8-390228f87aef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92937", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117287817060203283", "content": "ICYMI: 19 sev:CRIT CVEs in Node VM2, which is supposed to be a sandbox, but apparently it's built like the AI \"sandboxes.\"\nhttps://www.cve.org/CVERecord?id=CVE-2026-92934https://www.cve.org/CVERecord?id=CVE-2026-92935https://www.cve.org/CVERecord?id=CVE-2026-92937https://www.cve.org/CVERecord?id=CVE-2026-92938https://www.cve.org/CVERecord?id=CVE-2026-92939https://www.cve.org/CVERecord?id=CVE-2026-92940https://www.cve.org/CVERecord?id=CVE-2026-92941https://www.cve.org/CVERecord?id=CVE-2026-92944https://www.cve.org/CVERecord?id=CVE-2026-92946https://www.cve.org/CVERecord?id=CVE-2026-92947https://www.cve.org/CVERecord?id=CVE-2026-92948https://www.cve.org/CVERecord?id=CVE-2026-92950https://www.cve.org/CVERecord?id=CVE-2026-92951https://www.cve.org/CVERecord?id=CVE-2026-92953https://www.cve.org/CVERecord?id=CVE-2026-92954https://www.cve.org/CVERecord?id=CVE-2026-92955https://www.cve.org/CVERecord?id=CVE-2026-92956https://www.cve.org/CVERecord?id=CVE-2026-92957https://www.cve.org/CVERecord?id=CVE-2026-92960", "creation_timestamp": "2026-09-17T18:34:21.294741Z"} {"uuid": "00687559-bfad-4dec-93d8-390228f87aef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92937", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117287817060203283", "content": "ICYMI: 19 sev:CRIT CVEs in Node VM2, which is supposed to be a sandbox, but apparently it's built like the AI \"sandboxes.\"\nhttps://www.cve.org/CVERecord?id=CVE-2026-92934https://www.cve.org/CVERecord?id=CVE-2026-92935https://www.cve.org/CVERecord?id=CVE-2026-92937https://www.cve.org/CVERecord?id=CVE-2026-92938https://www.cve.org/CVERecord?id=CVE-2026-92939https://www.cve.org/CVERecord?id=CVE-2026-92940https://www.cve.org/CVERecord?id=CVE-2026-92941https://www.cve.org/CVERecord?id=CVE-2026-92944https://www.cve.org/CVERecord?id=CVE-2026-92946https://www.cve.org/CVERecord?id=CVE-2026-92947https://www.cve.org/CVERecord?id=CVE-2026-92948https://www.cve.org/CVERecord?id=CVE-2026-92950https://www.cve.org/CVERecord?id=CVE-2026-92951https://www.cve.org/CVERecord?id=CVE-2026-92953https://www.cve.org/CVERecord?id=CVE-2026-92954https://www.cve.org/CVERecord?id=CVE-2026-92955https://www.cve.org/CVERecord?id=CVE-2026-92956https://www.cve.org/CVERecord?id=CVE-2026-92957https://www.cve.org/CVERecord?id=CVE-2026-92960", "creation_timestamp": "2026-09-17T18:34:21.294741Z"} https://vulnerability.circl.lu/sighting/00687559-bfad-4dec-93d8-390228f87aef/export Thu, 17 Sep 2026 18:34:21 +0000 https://vulnerability.circl.lu/sighting/ed0add66-7e7d-4ac0-a402-58a0bf0e08a4/export {"uuid": "ed0add66-7e7d-4ac0-a402-58a0bf0e08a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92937", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvpzzgdmdy2w", "content": "\ud83d\udea8 CVE-2026-92937 \u2014 CVSS 10 CRITICAL\n\nvm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92937\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:08:32.655693Z"} {"uuid": "ed0add66-7e7d-4ac0-a402-58a0bf0e08a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92937", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvpzzgdmdy2w", "content": "\ud83d\udea8 CVE-2026-92937 \u2014 CVSS 10 CRITICAL\n\nvm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92937\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T16:08:32.655693Z"} https://vulnerability.circl.lu/sighting/ed0add66-7e7d-4ac0-a402-58a0bf0e08a4/export Thu, 17 Sep 2026 16:08:32 +0000 https://vulnerability.circl.lu/sighting/fd72283f-d08b-4eb9-9d9f-0a751dbed7ec/export {"uuid": "fd72283f-d08b-4eb9-9d9f-0a751dbed7ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92937", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvpzkdgdtk2t", "content": "CVE-2026-92937 - vm2\nThe vm2 sandbox library version 3.11.6 can be tricked into exposing the underlying Node.js process, allowing untrusted code to execute commands on the server. This occurs when a rejected\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T16:00:07.291284Z"} {"uuid": "fd72283f-d08b-4eb9-9d9f-0a751dbed7ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92937", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvpzkdgdtk2t", "content": "CVE-2026-92937 - vm2\nThe vm2 sandbox library version 3.11.6 can be tricked into exposing the underlying Node.js process, allowing untrusted code to execute commands on the server. This occurs when a rejected\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #patriksimek #CVE #infosec", "creation_timestamp": "2026-09-17T16:00:07.291284Z"} https://vulnerability.circl.lu/sighting/fd72283f-d08b-4eb9-9d9f-0a751dbed7ec/export Thu, 17 Sep 2026 16:00:07 +0000