CVE lookup

CVE-2026-93606

Pruva has a verified reproduction for CVE-2026-93606: vm2 before 3.12.1 sandbox escape via host-realm Promise Symbol.species (VM and NodeVM). The canonical evidence record is REPRO-2026-00383.

REPRO

REPRO-2026-00383

Package

patriksimek/vm2 · github

Severity

CRITICAL

Status

published

Open verified reproduction Plain text for agents NVD source