CVE-2026-93606

CVE-2026-93606 affects vm2 (npm) versions 3.12.0 and earlier, specifically the VM and NodeVM sandbox implementations. The root cause lies in lib/bridge.js: the bridge's rejection sanitizer only wraps then/catch rejection slots holding a function, and the Symbol.species/.then neutralization is app...