vm2 CVE-2026-92944

Requires (1) an application that runs attacker-controlled JavaScript inside vm2 versions 3.10.2 through 3.11.6 - the core vm2 threat model - and (2) the host running specifically on Node.js 26 with V8 14.6, whose stale PromiseThenLookupChain protector is the root cause. No special vm2 configuration (no require.external, no builtin allowlists, no unsafe options) is needed - this escapes a default vm2 setup - but the Node.js 26 runtime is a hard gate: identical vm2 versions on other Node major versions are not exploitable via this finding. Exploitation is remote and unauthenticated only in the sense that the sandbox itself is the attack surface; the practical prerequisite is that the deployment accepts and executes untrusted code.

This is a genuine high-priority sandbox escape, not a CVSS-inflated paper cut. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes remote, low-complexity, unauthenticated arbitrary code execution with full confidentiality/integrity/availability loss - consistent with a real vm2 sandbox escape where the whole security value of the product is defeated. The key mitigating factor is a runtime precondition the CVSS score does not capture: exploitation depends on Node.js 26 with V8 14.6 and its stale PromiseThenLookupChain protector, so deployments on other Node major versions are not affected by this specific finding. Signals are otherwise sparse and should be read honestly: no EPSS probability, no CISA KEV listing, and no explicitly published exploit code (a technical write-up likely exists in the GHSA/VulnCheck advisories but is not confirmed as weaponized PoC). Exploitation status is therefore 'no public exploit identified at time of analysis.' The overriding contextual gate is vm2's threat model - vm2 exists specifically to run untrusted JavaScript, so any escape is critical FOR THOSE deployments but irrelevant to installs that never feed attacker-controlled code to the sandbox. Net: treat as critical wherever vm2 runs untrusted input on Node 26; deprioritize where Node 26 is not in use.

An application uses vm2 (3.10.2-3.11.6) on Node.js 26 to sandbox untrusted user-supplied JavaScript (e.g. a code-runner, template engine, or plugin host). The attacker submits an async function whose returned Promise carries an attacker-controlled constructor via Symbol.species; because Promise.prototype.finally() bypasses vm2's wrapper due to the stale V8 protector, the attacker walks to the host Function constructor and process object and executes arbitrary code on the host. No public weaponized exploit is confirmed, though the advisory likely documents the technique.