Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Update: vm2: 19 kritische Sandbox-Escapes in NodeVM ermöglichen Codeausführung und Datendiebstahl https://cybersecurity-news.de/vm2-kritische-sandbox-escapes-nodevm-cve-2026-92934-92948
Post summary
The tweet discloses 19 critical sandbox‑escape vulnerabilities in vm2 (CVE‑2026‑92934‑92948) that enable code execution and data theft, but does not provide PoC, exploit tools, evidence of active exploitation, or patches.