CVE-2026-100722
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to an uncaught exception that terminates the host process.
Risk Assessment
Risk of host process termination (DoS) due to unhandled Promise rejection, potentially leading to application unavailability.
Recommendation
Upgrade vm2 to version 3.12.2 or later. If you use vm2 to execute untrusted code, consider migrating to alternative solutions such as isolated-vm that are actively maintained.
Other vulnerabilities in vm2
See all- CVE-2026-93604High
vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM. The sanitizer leaves crypto.setFips callable, allowing guest code to change the FIPS mode of the entire host process, crossing the NodeVM isolation boundary. Fixed in vm2 3.12.1.
- CVE-2026-92962Low
vm2, a sandbox for running untrusted JavaScript, in versions up to and including 3.11.3 uses prototype-walking index assignment in defaultSandboxPrepareStackTrace, allowing sandbox code to intercept error stack lines. The impact is low (information side channel) and the issue is fixed in version 3.11.4.
- CVE-2026-92952Medium
vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known dangerous registered symbols that omits nodejs.stream.disturbed and nodejs.stream.errored, which are exposed on host WebStream prototypes on newer Node.js releases. When the embedder exposes a host WebStream object and the host stream/web module to the sandbox, sandbox code can obtain the real host symbols and use them as write keys on host stream objects, corrupting host-visible stream state. This can bypass host logic that relies on Node's public stream-state helpers. It is not a host code-execution primitive in the reported proof of vulnerability. This is an incomplete fix for the earlier nodejs.* symbol filtering issue. Fixed in vm2 3.11.7.
- CVE-2026-92950High
A vulnerability in the vm2 CLI tool (before 3.11.7) allows sandbox escape and arbitrary code execution in the host Node.js process. Attackers can supply a malicious script that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.
- CVE-2026-92945Medium
vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled.
- CVE-2026-92936Medium
vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError and then read the error's .stack property, bypassing the sandbox-side host-path redaction. Default new VM() and new NodeVM() configurations are affected without any special options.
- CVE-2026-100721Critical
A vulnerability in vm2 before 3.12.2 allows an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver and `context: 'host'`, guest code can require an allowlisted module and then an absolute path of a non-allowlisted sibling sharing the resolved prefix. This leads to a sandbox escape and arbitrary code execution in the host process.
- CVE-2026-93606Critical
A vulnerability in the vm2 library (npm) versions up to 3.12.0 allows sandbox escape in VM and NodeVM. When an embedder exposes a host API returning a host-realm Promise, the rejection sanitizer does not cover all cases, and sandboxed code can overwrite Promise properties to obtain an unsanitized host object. This can lead to arbitrary code execution on the host. Fixed in 3.12.1.
- CVE-2026-93605Critical
A vulnerability in NodeVM of vm2 before 3.12.1 allows sandbox escape because the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host when NodeVM is configured with builtin:['*'] or explicit child_process allowance.
- CVE-2026-93603Critical
A vulnerability in vm2 through 3.12.0 (fixed in 3.12.1) involves incorrect handling of a nullish `this` receiver in the apply trap of its bridge. When sandboxed code calls a host-provided non-strict function without a receiver, the undefined receiver is passed through, and V8 substitutes the host realm's global object. vm2 returns that object to the sandbox, allowing a complete sandbox escape and access to process. Exploitation requires the embedding application to expose at least one non-strict host function.
Original NVD description (English source)
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to an uncaught exception that terminates the host process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS