CVE-2026-92944: vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector
vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper protections due to a stale PromiseThenLookupChain protector in V8 14.6. Attackers can exploit this by creating an async function that returns a Promise with an attacker-controlled constructor Symbol.species, allowing them to reach the host Function constructor and process object for arbitrary code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.6 - Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.10.2 - Compensating control
Mitigate sandbox escape by preventing untrusted code from executing in the vm2 environment until a fixed vm2 version is deployed.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using vm2 versions 3.10.2 through 3.11.6 on Node.js 26 are affected. The issue applies where untrusted code can execute in a vm2 sandbox.
What does an attacker need to exploit this?
An attacker needs the ability to run crafted code inside the vm2 sandbox. No privileges or user interaction are required; the exploit uses an async function returning a Promise with an attacker-controlled constructor Symbol.species.
What is the impact of a successful escape?
The attacker can reach the host Function constructor and process object, resulting in arbitrary code execution in the host environment.