Host Process Termination Vulnerability in vm2 by Patrik Simek

CVE-2026-100722

What is CVE-2026-100722?

The vm2 library, utilized in Node.js environments for sandboxing untrusted code, contains a vulnerability that fails to apply adequate handling for host-side Promise rejections. Specifically, versions prior to 3.12.2 do not securely manage Promise resolutions within the sandbox-to-host interaction. This oversight can be exploited when an untrusted script invokes a constructable host function returning a rejected native Promise. Consequently, if an unhandled rejection occurs, it escalates to an uncaught exception, abruptly terminating the host process due to Node's strict unhandled-rejection policy.

References