CVE-2026-92937

vm2 3.11.6 is vulnerable to a sandbox escape that lets untrusted code running inside the sandbox execute arbitrary code in the host Node.js process; it is an incomplete fix for GHSA-m283-3h24-438v, where the Promise-sanitising bridge gate (lib/bridge.js:1624) identity-checks only the direct call target. It is triggered when an embedder exposes a host-realm Promise to the sandbox (e.g., an async host function bridged via the sandbox option, or an async method of a NodeVM external module) that rejects with an Error carrying a non-primitive own property referencing a host object, and the attacker invokes the rejection handler through a Function.prototype.call or .apply indirection such as p.then.call(p, undefined, cb), which bypasses the sanitiser and delivers the raw host error with its own properties intact. The attacker thereby obtains a fully functional proxy to a host object and can reach Node internals, for example err.detail.mainModule.require('child_process'), to run arbitrary commands with the privileges of the host process. Any Node.js application embedding vm2 3.11.6 (or earlier builds carrying the incomplete fix) that bridges host Promises into the sandbox is affected; the direct p.then(undefined, cb), bind, and Reflect.apply forms are correctly sanitised. No public proof-of-concept is known, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported; a fixed version, 3.11.7, is available.

What to do: Upgrade vm2 to 3.11.7 immediately. Audit your embedding for host-realm Promises or async host functions (via the sandbox option or NodeVM external modules) that can reject with Errors carrying non-primitive own properties, and avoid exposing host objects such as process into error payloads. Given vm2's repeated history of sandbox escapes, consider running untrusted code under stronger isolation (e.g., a separate process/container or a hardened isolation library) rather than relying on vm2 alone.