Yms0Ra

**Name of the Vulnerable Software and Affected Versions** vm2 versions 3.10.2 through 3.11.6 **Description** A sandbox escape exists on Node.js 26 where `Promise.prototype.finally()` bypasses wrapper protections caused by a stale `PromiseThenLookupChain` protector in V8 14.6. An attacker can exploit this by creating an async function that returns a Promise with a controlled `Symbol.species` constructor, enabling access to the host `Function` constructor and `process` object for arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.