A CVSS 10.0 flaw in vm2 can let untrusted sandboxed code reach a live host object proxy through an incompletely sanitised rejected Promise, potentially yielding remote code execution in the host Node.js process where the affected bridging pattern is in use.
What Is It
CVE-2026-92937 is an incomplete fix for GHSA-m283-3h24-438v. The bridge gate in lib/bridge.js identity-checks only the direct call target when deciding whether to rebuild or sanitise a rejected host Promise value. Registering the rejection handler through Function.prototype.call or .apply indirection, for example p.then.call(p, undefined, cb), makes the intercepted target host Function.prototype.call instead of then, so the sanitiser never runs and the raw host error reaches sandbox code with its own properties intact.
The direct p.then(undefined, cb), bind, and Reflect.apply forms are correctly sanitised. The issue is classified CWE-94 (code injection).
Why It Matters
This is a full sandbox escape. If an embedder exposes a host-realm Promise to the sandbox and that Promise rejects with an Error carrying a non-primitive own property that references a host object (e.g. err.detail = process), untrusted sandbox code obtains a fully functional proxy to that host object. From there it can execute arbitrary commands with the privileges of the host process; the disclosure cites e.detail.mainModule.require('child_process').execSync(...).
The advisory rates this 10.0 CRITICAL. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: network-reachable, low complexity, no privileges, no user interaction, with scope change and high confidentiality, integrity, and availability impact.
The severity is compounded by the fact that vm2 is an abandoned project: its maintainer deprecated the package in 2023 after a series of unfixable sandbox escapes, so a vendor patch for this bypass is unlikely to arrive.
The supplied source material contains no CISA KEV entry for this CVE, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline.
What's Vulnerable
- Vendor/product: patriksimek
vm2(pkg:npm/vm2) - Affected: all published releases up to and including 3.11.6, the version the VulnCheck advisory identifies for this bypass; including the 3.9.x line and every earlier release
- Unaffected: the advisory sources identify no unaffected version; the package is deprecated, so no fixed release is listed
Exposure requires an embedder that bridges a host-realm Promise into the sandbox; an async host function passed via the sandbox option, or a NodeVM external module's async method.
Patch Status
No patch is available, and none appears to be planned. vm2 is deprecated; the advisory sources list no maintained release that fixes this bypass, and the lib/bridge.js gate design that permits it remains in the last published build.
Remediation requires removing vm2 from the dependency tree. Replace it with a sandbox that enforces isolation at the V8 or OS boundary rather than by proxying host objects, isolated-vm, a separate child process under strict privilege limits, a WebAssembly runtime, or a container-level boundary. As an interim measure, stop passing host-realm Promises and async host functions into vm2 sandboxes, since that bridging is the precondition for exploitation.
NVD lists the record as Deferred, published 2026-09-17, sourced from [email protected]. A Deferred status means NVD does not plan to enrich the record further, so the advisory sources below are authoritative for affected-version detail.