vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector

Reporter - Name or handle: YMsora - Report date: 2026-08-14 Summary The latest published vm2 release, 3.11.5, and the current main branch are vulnerable to a sandbox escape when used on Node.js 26. An ordinary fulfilled Promise created by an async function can retain an attacker-controlled...