CVE-2026-92954

vm2 is a Node.js sandbox library for running untrusted JavaScript. In versions 3.10.0 through 3.11.7 , Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary. Only sandbox-created Promises receive a rejection-swallowing wrapper, and host-side rejec...