vm2 3.11.6 Remote Code Execution via Promise call/apply

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-92937 · Microsoft / collected KEV context

EUVD-2026-81587

GHSA-3f84-vwv5-r42g

GHSA-647f-g98j-qq25

cve-program · CVE-2026-92937

• https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25
• https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply

euvd · EUVD-2026-81587

• https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25
• https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply

nvd · CVE-2026-92937

• https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25
• https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply

osv · GHSA-3f84-vwv5-r42g

• https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25
• https://nvd.nist.gov/vuln/detail/CVE-2026-92937
• https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply

osv · GHSA-647f-g98j-qq25

• https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25
• https://nvd.nist.gov/vuln/detail/CVE-2026-92937
• https://github.com/patriksimek/vm2/commit/315786904c416be68ff2517b86fb9d71fa6761db
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.7
• https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply

• vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when… · Advisory content revised · 1 Nov 2026