vm2 CVE-2026-100722

Exploitation requires that the embedding application (1) runs untrusted scripts through vm2's VM.run, and (2) exposes to the sandbox a constructable host function whose constructor returns a native rejected Promise - this specific embedder integration is the AT:P precondition and is not vm2's default behavior. It further depends on running under Node's strict unhandled-rejection policy (default in modern Node versions), which promotes the unhandled rejection to a process-terminating uncaught exception. No authentication or user interaction beyond the attacker submitting a script is needed (PR:N/UI:N), because feeding untrusted code to the sandbox is the intended use case. Deployments of vm2 that do not expose such a constructable, Promise-returning host constructor are not exploitable via this path.

This is a genuine but conditional denial-of-service issue, not an inflated high-CVSS finding. The vendor CVSS 4.0 score of 8.9 is driven entirely by availability (VA:H/SA:H) with VC:N/VI:N - there is no confidentiality or integrity impact, only host process termination via CWE-248 (uncaught exception). Signals are consistent internally: AV:N/PR:N/UI:N reflect the sandbox threat model (any untrusted script run via VM.run is the attacker), while AT:P correctly captures the required precondition that the embedder must expose a constructable host function whose constructor returns a native rejected Promise - a non-default integration pattern that meaningfully narrows real-world exposure. No EPSS score, KEV listing, or POC is present in the input, so exploitation must be treated as no public exploit identified at time of analysis. The 8.9 is high because a full host-process crash is severe for a security library whose entire purpose is safely running untrusted code, but the specific embedder configuration requirement means it is not universally exploitable against every vm2 deployment. Note: vm2 is deprecated (unmaintained since 2023), which raises the practical concern that many embedders will not patch - argue for prioritizing migration to isolated-vm over relying on the 3.12.2 fix alone.

A service embeds vm2 to run untrusted user scripts and exposes to the sandbox a constructable host function whose constructor internally returns a native rejected Promise. An attacker submits a script that calls that function with new and discards the result; the rejected host Promise crosses the sandbox-to-host bridge without markHostPromiseHandled() being applied on the construct path, and under Node's strict unhandled-rejection policy it becomes an uncaught exception that terminates the entire host process. No public exploit code is identified in the available data.