vm2 CVE-2026-47210

Exploitation requires that (1) the target application uses vm2 <= 3.11.3 as a security boundary around attacker-influenced JavaScript, (2) the Node.js runtime exposes WebAssembly JSPI - Node 26+ where it is enabled by default, or Node 24 launched with --experimental-wasm-jspi, and (3) the sandboxed code path supports async execution sufficient to reach Promise.prototype.finally on a WebAssembly.promising-derived promise. No authentication is required at the vm2 layer (PR:N) and no user interaction is needed (UI:N), but exploitation is limited to deployments meeting the runtime version/flag condition above - vm2 running on Node 22 LTS or any Node 24 instance without the experimental JSPI flag is not exposed via this specific path. Whether an external attacker reaches the sandbox depends on whether the host application accepts attacker-controlled JS, which is the typical use case for vm2.

Risk is high and concrete. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects unauthenticated remote code execution with low complexity once attacker-controlled JS reaches a vm2 sandbox, which matches the threat model vm2 is explicitly deployed to defend against. EPSS and CISA KEV status were not provided in the input, so widespread exploitation cannot be confirmed; however, a fully working PoC is published in the advisory, so the barrier to weaponization is effectively zero. A practical limit on real-world risk is the runtime requirement: the path is reachable by default only on Node 26+, or on Node 24 with --experimental-wasm-jspi explicitly enabled, so deployments on Node 22 LTS and earlier are not exposed via this specific vector. Note that vm2 itself has been deprecated upstream in favor of isolated-vm; the package remains in production use, but defenders should treat any continued reliance on it as elevated risk independent of this CVE.

An attacker submits JavaScript payload to a service that uses vm2 to sandbox user code (e.g., a serverless function evaluator, automation rule engine, or low-code expression runtime) running on Node 26. The payload instantiates a tiny wasm module with a Suspending import, calls WebAssembly.promising on its export to obtain a JSPI promise, overrides constructor to a class whose species reads the rejection's constructor.constructor('return process')(), and calls .finally() - yielding host process and execSync('child_process'), giving the attacker arbitrary command execution on the host with the service's privileges. A fully working PoC is published in the GHSA advisory.