CVE-2026-93606Critical· 10.0▾ AbyssalPoC availablevm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer (hostPromiseSanitizeReject / makeSanitizedPromis…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 55 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.5%
0.5% → 0.7%
vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in VM and NodeVM. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer (hostPromiseSanitizeReject / makeSanitizedPromiseCallback / normalizeHostPromiseCallbacks in lib/bridge.js) only wraps then/catch rejection slots that hold a function, and the sandbox-side Symbol.species/.then neutralization is installed only on the sandbox intrinsic Promise.prototype, so it never applies to a host Promise. Code running inside the sandbox can overwrite p.constructor[Symbol.species] on the host Promise and then call p.then() with no onRejected handler; V8 substitutes its internal Thrower, which re-throws the raw host rejection value into a resolve/reject closure captured by the attacker. This delivers an unsanitized, fully functional bridge proxy of the host object to sandboxed code, bypassing handleException and hostPromiseSanitizeReject. If the rejection value is host-pivotable (for example a host process object), this results in arbitrary code execution on the host. Fixed in 3.12.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100723High· 7.5vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules
CVE-2026-93603Critical· 10.0vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code calls a host-provided non-strict (sloppy-mode) function without a receiver — e.…
CVE-2026-92962Low· 2.1vm2 is a sandbox for running untrusted JavaScript
CVE-2026-92959High· 7.1vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM
CVE-2026-92949Medium· 4.0vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections
CVE-2026-92933Medium· 5.8vm2 is a sandbox for running untrusted Node.js code