vm2 3.11.6 Remote Code Execution via Promise call/apply

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92937 · CVE overview and exploitation status

EUVD-2026-81587

GHSA-3f84-vwv5-r42g

GHSA-647f-g98j-qq25

cve-program · CVE-2026-92937

• https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25
• https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply

euvd · EUVD-2026-81587

• https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25
• https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply

nvd · CVE-2026-92937

• https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25
• https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply

osv · GHSA-3f84-vwv5-r42g

• https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25
• https://nvd.nist.gov/vuln/detail/CVE-2026-92937
• https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply

osv · GHSA-647f-g98j-qq25

• https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25
• https://nvd.nist.gov/vuln/detail/CVE-2026-92937
• https://github.com/patriksimek/vm2/commit/315786904c416be68ff2517b86fb9d71fa6761db
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.7
• https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply

• vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when… · Advisory content revised · 1 Nov 2026