vm2 CVE-2026-92954

Requires that the target application embeds vm2 (3.10.0 through 3.11.7) to execute untrusted/attacker-controlled JavaScript inside a NodeVM sandbox AND exposes at least one host-realm Promise-returning API to that sandbox - the advisory cites events.once() via the NodeVM events builtin, or any embedder-provided Promise-returning function. Exploitation is trivial once inside the sandbox (call the API, ignore the rejected Promise), with no authentication or user interaction beyond code submission, but it is fully gated by this sandbox-with-untrusted-code deployment model: applications that do not run untrusted JS, or that do not surface a host Promise API into the sandbox, are not exposed. Limiting factors: the host process must be running Node.js with default unhandled-rejection-terminates behavior, and the fix (3.11.8) neutralizes it.

This is a genuine but conditional availability threat, not a broad-internet emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H, base 9.2) is availability-only and correctly reflects that there is NO confidentiality or integrity impact - the sole outcome is a host-process crash (CWE-248 uncaught exception / unhandled Promise rejection). The high score is driven entirely by VA:H plus SA:H (the subsequent host system), which is why it lands 'critical' despite being 'just' a denial of service. The critical caveat the raw score hides: exploitation presupposes the vm2 threat model - the embedding application must already be executing attacker-controlled JavaScript inside a vm2 NodeVM sandbox that exposes a host Promise-returning API (e.g. the events builtin's events.once()). That is vm2's entire purpose, so PR:N/AC:L are defensible for products that use vm2 as designed, but it is emphatically NOT 'any remote attacker against any host.' On exploitation signals: no CISA KEV entry, no EPSS score provided, and no explicit public POC in the input (the advisory describes the mechanism in enough detail to reproduce, but no weaponized code is confirmed) - so this is 'no public exploit identified at time of analysis.' Contrast with the higher-value RCE members of this same vm2 wave (e.g. CVE-2026-92956 default-config escape, CVE-2026-92955): those grant code execution; this one only kills the process. Net: a real, patch-worthy DoS for anyone running vm2 3.10.0-3.11.7 with untrusted code, but lower operational priority than the RCE siblings and lower than the CVSS 9.2 alone would suggest.

An application uses vm2 (3.10.0-3.11.7) to run untrusted user-supplied JavaScript and exposes a host Promise-returning API such as events.once() through the NodeVM events builtin. The attacker submits sandbox code that calls that host function, receives a Promise that will reject, and simply discards the return value; because the bridge never marked the host Promise as handled, Node.js's default unhandled-rejection behavior terminates the entire host process, taking down the service. No weaponized POC is confirmed, though the advisory documents the mechanism precisely.