CVE-2026-93606

CVE-2026-93606 affects vm2 (npm) versions 3.12.0 and earlier, specifically the VM and NodeVM sandbox implementations. The root cause lies in lib/bridge.js: the bridge's rejection sanitizer only wraps then/catch rejection slots holding a function, and the Symbol.species/.then neutralization is app...

EUVD-2026-82901

vm2 npm versions 3.12.0 and earlier contain a sandbox escape in VM and NodeVM. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer hostPromiseSanitizeReject / makeSanitizedPromiseCallback / normalizeHostPromiseCallbacks in lib/bridge.js only wra...