vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92936 · CVE overview and exploitation status

EUVD-2026-81586

GHSA-63m2-qqch-jxv2

GHSA-x6m4-chr9-cg97

cve-program · CVE-2026-92936

• https://github.com/patriksimek/vm2/security/advisories/GHSA-x6m4-chr9-cg97
• https://www.vulncheck.com/advisories/vm2-3.11.0-before-3.11.7-information-disclosure-via-error-stack

euvd · EUVD-2026-81586

• https://github.com/patriksimek/vm2/security/advisories/GHSA-x6m4-chr9-cg97
• https://www.vulncheck.com/advisories/vm2-3.11.0-before-3.11.7-information-disclosure-via-error-stack

nvd · CVE-2026-92936

• https://github.com/patriksimek/vm2/security/advisories/GHSA-x6m4-chr9-cg97
• https://www.vulncheck.com/advisories/vm2-3.11.0-before-3.11.7-information-disclosure-via-error-stack

osv · GHSA-63m2-qqch-jxv2

• https://github.com/patriksimek/vm2/security/advisories/GHSA-x6m4-chr9-cg97
• https://nvd.nist.gov/vuln/detail/CVE-2026-92936
• https://www.vulncheck.com/advisories/vm2-3.11.0-before-3.11.7-information-disclosure-via-error-stack

osv · GHSA-x6m4-chr9-cg97

• https://github.com/patriksimek/vm2/security/advisories/GHSA-x6m4-chr9-cg97
• https://nvd.nist.gov/vuln/detail/CVE-2026-92936
• https://github.com/patriksimek/vm2/commit/5d5ba5343af571c688a3a81cefad2de25b94180a
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.7
• https://www.vulncheck.com/advisories/vm2-3.11.0-before-3.11.7-information-disclosure-via-error-stack

• vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError (for example by calling eval … · Advisory content revised · 11 Nov 2026