Sandbox Escape Vulnerability in vm2 Product by npm

CVE-2026-93606

What is CVE-2026-93606?

A security issue was identified in vm2, an npm package, whereby versions 3.12.0 and earlier are susceptible to a sandbox escape. This vulnerability occurs when the embedder exposes a host API that returns a Promise. The rejection sanitizer mechanism used fails to wrap all rejection cases effectively, particularly those involving host Promises. A malicious actor may exploit this flaw to manipulate the host's Promise, thereby allowing execution of arbitrary code in the host environment through a sandboxed context. This can lead to severe consequences, potentially enabling the attacker to execute arbitrary commands on the host system. Users are advised to upgrade to vm2 version 3.12.1 or later to mitigate this risk.

References