vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92962 · CVE overview and exploitation status

EUVD-2026-81612

GHSA-2c9f-f88g-g76p

GHSA-q3fm-4wcw-g57x

cve-program · CVE-2026-92962

• https://github.com/patriksimek/vm2/security/advisories/GHSA-q3fm-4wcw-g57x
• https://www.vulncheck.com/advisories/vm2-before-3.11.4-defense-invariant-violation-via-setup-sandbox-js

euvd · EUVD-2026-81612

• https://github.com/patriksimek/vm2/security/advisories/GHSA-q3fm-4wcw-g57x
• https://www.vulncheck.com/advisories/vm2-before-3.11.4-defense-invariant-violation-via-setup-sandbox-js

nvd · CVE-2026-92962

• https://github.com/patriksimek/vm2/security/advisories/GHSA-q3fm-4wcw-g57x
• https://www.vulncheck.com/advisories/vm2-before-3.11.4-defense-invariant-violation-via-setup-sandbox-js

osv · GHSA-q3fm-4wcw-g57x

• https://github.com/patriksimek/vm2/security/advisories/GHSA-q3fm-4wcw-g57x
• https://github.com/patriksimek/vm2/commit/ad31adc1fc4a2c163f2f8c11ab4af206074528fd
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.4

No related changes are available here.