Protection Mechanism Failure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Protection Mechanism Failure via the WebAssembly.compileStreaming and WebAssembly.instantiateStreaming functions. An attacker can gain access to the...

PT-2026-94327

Name of the Vulnerable Software and Affected Versions vm2 versions 3.10.1 through 3.11.6 Description A sandbox escape exists when running on Node.js 26. The issue occurs because WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects wit...