AllowAsync Bypass in vm2 Affecting Node.js and VM Users

CVE-2026-92959

What is CVE-2026-92959?

The vm2 library, prior to version 3.11.8, does not adequately enforce the allowAsync: false restriction in its virtual machine implementations, namely VM and NodeVM. Although localPromise.prototype.then is adjusted to throw an error when async behavior is not allowed, the Promise static methods (Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled) can still accept attacker-controlled thenables. This leads to a situation where malicious scripts executed within the sandbox can manipulate asynchronous tasks, allowing code execution beyond the intended timeout and lifecycle of VM.run() or NodeVM.run(). Consequently, this vulnerability exposes systems to potential exploitation as scripts can operate after the host believes processing is complete.

References