CVE-2026-92956: vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default new VM() sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling Symbol.species via Promise.prototype.finally, sandbox code receives that raw host error, walks from the host error constructor to the host Function constructor, and recovers the real host process object, gaining host Node.js capabilities (e.g. access to host modules such as fs) in the context of the process running the sandbox. No NodeVM, require permission, host object injection, or otherwise unsafe configuration is required. This is a bypass of the fix for GHSA-6j2x-vhqr-qr7q, which removed the JSPI entry points WebAssembly.promising and WebAssembly.Suspending. The issue is fixed in 3.11.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.7Patch GHSA-6j2x-vhqr-qr7q - Operational
Update vm2 from 3.10.1–3.11.6 to 3.11.7 to address the sandbox escape reachable from a default `new VM()` when running on Node.js 26.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using vm2 versions 3.10.1 through 3.11.6 on Node.js 26 are exposed. A default new VM() sandbox is affected; NodeVM, require permission, host object injection, or other unsafe configuration is not needed.
What level of attacker access is required?
An attacker needs the ability to execute controlled JavaScript inside the vm2 sandbox. They do not need prior privileges, user interaction, or access to injected host objects.
What can an attacker do after exploitation?
Sandbox code can recover the real host process object and gain the capabilities of the Node.js process running the sandbox. This can include access to host modules such as fs.
What should be done if the affected version is in use?
Update vm2 to version 3.11.7, which fixes the issue. The provided information does not identify a configuration-based mitigation for affected Node.js 26 deployments.