Sandbox Escape in vm2 from Node.js 26 by Patrik Simek

CVE-2026-92956

What is CVE-2026-92956?

The vm2 library versions 3.10.1 through 3.11.6 are susceptible to a sandbox escape vulnerability when utilized in a Node.js 26 environment. Exploiting the WebAssembly.compileStreaming and WebAssembly.instantiateStreaming functions, attackers can manipulate the Promise object to gain unwanted access to the host environment. By controlling Symbol.species and utilizing Promise.prototype.finally, the malicious code can traverse from the host error constructor to the host Function constructor, ultimately obtaining the real host process object. This grants attackers privileged access to Node.js capabilities, such as file system manipulation, without requiring unsafe configurations. The vulnerability has been addressed in version 3.11.7.

References