GHSA-P6VX-979V-RG4C Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

A fulfilled Promise node deserialized by fromJSON can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in [email protected] GHSA-mv8w-475r-vwqw / CVE-2026-59940 and affects every plugin-capable release fr...

NPM: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

NPM: Seroval: fromJSON Promise thenable assimilation invokes plugin-produced callables bypass of GHSA-mv8w-475r-vwqw vulnerability discovered by ? in WordPress Npm seroval versions = 0.12.0, = 1.6.0...

GHSA-F8GF-W286-FMQ2 vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM

Summary When allowAsync is set to false, vm2 is expected to reject attempts to run asynchronous code. Direct use of Promise.prototype.then is blocked, but Promise static methods still assimilate attacker-controlled thenables. Promise.resolvethenable, Promise.allthenable, Promise.racethenable,...

NPM: vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM

NPM: vm2: allowAsync: false can be bypassed through Promise thenable assimilation in VM and NodeVM vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.7...

Duplicate Advisory: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8gf-w286-fmq2. This link is maintained to preserve external references. Original Description vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While...

CVE-2026-92959

CVE-2026-92959 affects vm2 (a Node.js sandboxing library) versions prior to 3.11.8 . The vulnerability lies in the incomplete enforcement of the allowAsync: false option in VM and NodeVM. Although localPromise.prototype.then is patched to throw 'Async not available', the sandbox's Promise static ...

CVE-2026-92959 vm2 before 3.11.8 allowAsync Bypass via Promise Thenable

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...