Remote Code Execution Vulnerability in vm2 by Patrik Simek

CVE-2026-92937

What is CVE-2026-92937?

The vm2 3.11.6 release contains a vulnerability that allows an attacker to escape the sandbox and execute arbitrary code within the host Node.js process. This issue arises from inadequate handling of Promise rejections. Specifically, when a Promise rejection handler is registered via Function.prototype.call or .apply, it circumvents necessary sanitization checks, exposing the host object to untrusted code. As a result, attackers could exploit this to gain unauthorized access to the host environment and execute potentially harmful commands while inheriting the host's privileges. The vulnerability has been addressed in vm2 version 3.11.7, which introduces appropriate checks to prevent such abuse.

References