Protection mechanism failure in vm2 - #VU146042
Published: August 28, 2026
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the host system and disclose sensitive information.
The vulnerability exists due to a protection mechanism failure in handleException error sanitization for AggregateError in vm2 when processing a host-wrapped AggregateError that is revisited within a single exception-handling traversal. A remote attacker can trigger a crafted host exception through an exposed host function to execute arbitrary code on the host system and disclose sensitive information.
The issue occurs on the caught-exception throw channel and is limited to AggregateError-based cyclic or duplicate reference shapes such as self-cycles, mutual-cycles, or the same host aggregate referenced multiple times in errors[].