CVE-2026-92959

A flaw was found in vm2, a JavaScript sandbox. This vulnerability allows a sandboxed script to bypass security restrictions designed to prevent asynchronous code execution. An attacker can exploit this by using specific Promise methods to assimilate malicious 'thenables,' enabling code to run...

CVE-2026-92959 vm2 before 3.11.8 allowAsync Bypass via Promise Thenable

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...