A critical sandbox escape is reported against the vm2 Node.js library, which the advisory describes as allowing untrusted code to break out to the host and execute arbitrary commands. It is scored 9.8 on CVSS v3.1. The report has not been independently reproduced, so the escape should be treated as advisory-claimed rather than confirmed.
What Is It
Per the advisory, the vm2 library contains a sandbox escape reachable through Promise handling: an attacker crafts an async function returning a Promise with an attacker-controlled constructor Symbol.species, which is said to let them reach the host Function constructor and process object, and from there, arbitrary code execution on the host.
The advisory attributes the bypass to a stale V8 Promise protector and scopes it to a specific Node.js/V8 runtime pairing. Those mechanism details should be treated as unverified: they have not been corroborated by an independent reproduction, and the affected-version data they accompany does not match vm2's actual release history (see below). What is consistent across the record is the class of flaw and the escape path; a Promise-based route around vm2's wrapper protections.
The flaw is classified as CWE-693 (Protection Mechanism Failure), which is precisely the failure mode: the guardrail is present but no longer holds.
Why It Matters
CVSS v3.1 base score is 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS v4.0 score is 9.3 (CRITICAL). Network attack vector, low complexity, no privileges, no user interaction, and full compromise of confidentiality, integrity, and availability.
vm2 exists to run untrusted code. Anything using it as a security boundary, plugin runtimes, serverless code evaluators, templating engines, online sandboxes, is handing attackers the exact input path this bug would need. A successful escape reaches process, meaning host-level code execution in the context of the Node.js application.
No CISA KEV entry accompanies this record, so there is no confirmed active exploitation or federal remediation deadline at this time.
What's Vulnerable
- Vendor/product: patriksimek / vm2 (
pkg:npm/vm2) - Advisory-claimed affected range: 3.10.2 up to (but not including) 3.11.7
- Reality check: the version range in this record does not appear to correspond to any installable release. None of the cited sources establish that 3.10.x or 3.11.x was ever published; based on vm2's public npm registry listing and the state of its GitHub repository, the published release line ends in the 3.9.x series, and the project appears to have been discontinued and its repository archived in 2023 following earlier critical sandbox escapes. That assessment comes from the package's public distribution record rather than from the advisory or NVD, and readers relying on it should confirm against the registry and repository directly.
NVD lists no CPE entries for this record; the version scoping comes from vendor-supplied affected data and is unconfirmed. Practically, any deployment still pinned to vm2, that is, anything on 3.9.x or earlier, should be assumed exposed to Promise-based escape techniques of this class, because the library appears to be no longer maintained and no further fixes should be expected.
Patch Status
There is no apparent upgrade path within vm2. The "unaffected in 3.11.7" guidance in this record cannot be acted on if, as the public release record indicates, that version does not exist; likewise, the two upstream commits referenced below (linked in the Sources section) land on a repository that appears to be archived. GitHub Security Advisory GHSA-27g9-p43v-cw3v is published for the record. vulnStatus in NVD is currently "Deferred," with the record published and last modified on 2026-09-17.
The remediation is migration, not patching. Teams using vm2 as a trust boundary should move off it, to an out-of-process or VM-level isolation model, or to a maintained in-process isolate such as isolated-vm, and should note that Node's built-in node:vm module is explicitly not a security boundary. Given vm2's history as a repeat sandbox-escape target and its apparent unmaintained status, this should be treated as urgent, along with a reassessment of whether in-process JavaScript sandboxing is the right control at all.
Sources
- NVD, CVE-2026-92944: https://nvd.nist.gov/vuln/detail/CVE-2026-92944
- GitHub Security Advisory GHSA-27g9-p43v-cw3v: https://github.com/patriksimek/vm2/security/advisories/GHSA-27g9-p43v-cw3v
- VulnCheck Advisory: https://www.vulncheck.com/advisories/vm2-3.10.2-through-3.11.6-sandbox-escape-via-promise-protector
- vm2 commit 4635ddd: https://github.com/patriksimek/vm2/commit/4635ddd85839461c8ad791990023a477efefe7bd
- vm2 commit 7b26e81: https://github.com/patriksimek/vm2/commit/7b26e81087ec88c287d9a4812f969d412f32774e