Sandbox Escape Vulnerability in vm2 for Node.js 26

CVE-2026-92944

What is CVE-2026-92944?

The vm2 library, used in Node.js applications, has a vulnerability that allows for sandbox escape due to improper handling of Promise.prototype.finally(). This occurs in versions 3.10.2 through 3.11.6, where the stale PromiseThenLookupChain protector in V8 14.6 enables attackers to craft an asynchronous function returning a Promise. This function can include a malicious constructor via Symbol.species, granting access to the host Function constructor and the process object, which may lead to arbitrary code execution. Users of these versions are advised to review the patches and take immediate action to mitigate potential risks.

References