BACK

Severity:

CRITICAL RISK

(10.0)

Sandbox Escape (CWE-94) in vm2 Node.js Runtime Host

CVE-2026-92937

Sep 17, 2026

Deferred

Vulnerability Type

Category:

Sandbox Escape

CWE:

CWE-94

Impact:

Remote Code Execution

Severity:

CRITICAL RISK

(10.0)

CVSS Version:

3.1

Catch This CVE While Code Is Being Written

Detect vulnerable code directly in pull requests, so CVEs are fixed before merge.

Get Started

text

Summary

Affected Context

Exploit Preconditions

Why This Happens

Potential Impact

General Mitigation Guidance

How Teams Detect Issues Like This

Frequently Asked Questions

Source

NDV

[FAQ]

Frequently Asked
Questions

What is Framer?

More from CodeAnt

VIEW ALL

BOOK A DEMO

Mar 3, 2026

CVE-2026-29000: pac4j-jwt Auth Bypass PoC With a Public Key

CVE-2026-29000

CVSS 10

Mar 3, 2026

CVE-2026-29000: pac4j-jwt Auth Bypass PoC With a Public Key

CVE-2026-29000

CVSS 10

Mar 9, 2026

CVE-2026-28292: simple-git RCE via Case-Sensitivity Bypass

CVE-2026-28292

CVSS 9.8

Mar 9, 2026

CVE-2026-28292: simple-git RCE via Case-Sensitivity Bypass

CVE-2026-28292

CVSS 9.8

Mar 11, 2026

CVE-2026-31988: jszip DoS via Malformed ZIP File

CVE-2026-31988

CVSS 6.9

Mar 11, 2026

CVE-2026-31988: jszip DoS via Malformed ZIP File

CVE-2026-31988

CVSS 6.9

[GET STARTED]

Find out what's already

exploitable in your codebase.

Find out what's already

exploitable in your codebase.

Find out what's already exploitable in your codebase.

START PENTEST

NO CC REQUIRED

BOOK A DEMO

CodeAnt AI

355 Bryant St, San Francisco, CA 94107

CodeAnt AI

355 Bryant St, San Francisco, CA 94107