vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection (Critical severity, CVE-2026-92937)
A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.
Key points
- vm2 (npm) has a critical flaw.
- Tracked as CVE-2026-92937.
- Version 3.11.7.
Maintainers of vm2, a package in the npm ecosystem, have published a critical-severity security advisory (CVE-2026-92937): vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection.
At a glance
- Advisory
- GHSA-647f-g98j-qq25
- CVE
- CVE-2026-92937
- Package
- vm2 (npm)
- Severity
- Critical
- Patched in
- 3.11.7
What is the issue?
The GitHub-reviewed advisory explains: Summary Untrusted JavaScript run by vm2 can escape the sandbox and execute arbitrary commands in the host Node.js process when an embedder-exposed host Promise rejects. This is an incomplete fix for GHSA-m283-3h24-438v: the advisory's capability-bearing rejection rebuild runs only through this direct Promise-handler path, so call/apply indirection bypasses the protection it introduced. The bridge sanitises host rejection values before sandbox callbacks run, but the gate at lib/bridge.js:1624 identity-checks only the direct call target. Registering the rejection handler through Function.prototype.call indirection, p.then.call(p, undefined, cb), makes the intercepted target host Function.prototype.call, so the sanitiser never runs and the raw host error reaches the sandbox (lib/bridge.js:1639) without the rebuild that strips host references carried by its own properties (lib/setup-sandbox.
Affected versions
| Ecosystem | Package | Vulnerable | Patched |
|---|---|---|---|
| npm | vm2 | = 3.11.6 | 3.11.7 |
The advisory lists a CVSS score of 10.0.
How to fix it
- Upgrade the affected package to the first patched version listed above.
- Rebuild and redeploy applications that bundle the vulnerable dependency.
- Run your dependency scanner (npm audit, pip-audit, Dependabot) to find transitive uses.
- Review the advisory references for workaround details if you cannot upgrade yet.
What to do and how to stay safe: CVE-2026-92937
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-92937?
CVE-2026-92937 is a security vulnerability in vm2 (npm).
Which version fixes CVE-2026-92937?
The fix is in version 3.11.7.
