CVE-2026-92944 Details
Description
vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper protections due to a stale PromiseThenLookupChain protector in V8 14.6. Attackers can exploit this by creating an async function that returns a Promise with an attacker-controlled constructor Symbol.species, allowing them to reach the host Function constructor and process object for arbitrary code execution.
A sandbox escape vulnerability has been identified in vm2 versions 3.10.2 through 3.11.6, specifically when running on Node.js 26. This vulnerability arises because Promise.prototype.finally() can bypass vm2's protective wrappers. The issue is rooted in a stale PromiseThenLookupChain protector in V8 version 14.6. Exploitation involves creating an asynchronous function that returns a Promise with a manipulated constructor Symbol.species, enabling access to the host Function constructor and the process object, which could lead to arbitrary code execution.
Users can upgrade to vm2 version 3.11.7, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/patriksimek/vm2/security/advisories/GHSA-27g9-p43v-cw3v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/patriksimek/vm2/commit/4635ddd85839461c8ad791990023a477efefe7bd | [email protected] | Broken LinkSource CodeVendor |
| https://github.com/patriksimek/vm2/commit/7b26e81087ec88c287d9a4812f969d412f32774e | [email protected] | Broken LinkSource CodeVendor |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-27g9-p43v-cw3v | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/vm2-3.10.2-through-3.11.6-sandbox-escape-via-promise-protector | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vm2 | >= 3.10.2, <= 3.11.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 19, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |