EUVD-2026-82901
GHSA-q84h-7qfg-c6j8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Untrusted sandboxed code is the attacker (PR:N/AV:N), the technique is deterministic (AC:L), and escape crosses the sandbox-to-host boundary (S:C) yielding full host RCE (C/I/A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in VM and NodeVM. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer (hostPromiseSanitizeReject / makeSanitizedPromiseCallback / normalizeHostPromiseCallbacks in lib/bridge.js) only wraps then/catch rejection slots that hold a function, and the sandbox-side Symbol.species/.then neutralization is installed only on the sandbox intrinsic Promise.prototype, so it never applies to a host Promise. Code running inside the sandbox can overwrite p.constructor[Symbol.species] on the host Promise and then call p.then() with no onRejected handler; V8 substitutes its internal Thrower, which re-throws the raw host rejection value into a resolve/reject closure captured by the attacker. This delivers an unsanitized, fully functional bridge proxy of the host object to sandboxed code, bypassing handleException and hostPromiseSanitizeReject. If the rejection value is host-pivotable (for example a host process object), this results in arbitrary code execution on the host. Fixed in 3.12.1.
Articles & Coverage 1
AnalysisAI
Sandbox escape in vm2 3.12.0 and earlier allows unauthenticated remote attackers who can supply JavaScript to an application embedding vm2's VM or NodeVM to break out of the sandbox and execute arbitrary code on the host, provided the embedder exposes at least one host API returning a host-realm (native) Promise whose rejection value is host-pivotable - the advisory cites a host process object as the example. The flaw is an incomplete rejection-sanitization failure in lib/bridge.js: the sandbox-side Symbol.species and .then neutralization is installed only on the sandbox intrinsic Promise.prototype, so it never applies to host Promises, letting sandboxed code overwrite p.constructor[Symbol.species] and call p.then() without an onRejected handler, after which V8's internal Thrower re-throws the raw host rejection value into an attacker-controlled resolve/reject closure, bypassing handleException and hostPromiseSanitizeReject and yielding an unsanitized, fully functional bridge proxy of the host object. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the embedding application (1) uses vm2 VM or NodeVM to execute attacker-controlled/untrusted JavaScript, and (2) exposes at least one host API to the sandbox that returns a host-realm (native) Promise whose rejection value is host-pivotable - the advisory specifically cites a host process object. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority issue, not a high-CVSS-but-low-risk paper cut. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade vm2 to 3.12.1, the vendor-released patch, as the primary fix per the GitHub advisory GHSA-6454-5x88-m6jw and the VulnCheck advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every application, service, plugin host, and CI job that embeds vm2 and determine which run version 3.12.0 or earlier, prioritizing anything reachable by untrusted or customer-supplied JavaScript; raise monitoring and EDR alerting on those hosts and confirm no unexplained host-realm processes are spawning. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-693 – Protection Mechanism Failure
View allShare
External POC / Exploit Code
Leaving vuln.today