PT-2026-38392 · Npm · Vm2

Kodove

·

CVE-2026-44001

·

Published

2026-05-01

·

Updated

2026-08-06

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0
Description A sandbox escape issue exists where sandboxed code can crash the host Node.js process. This occurs when a Promise constructor triggers an unhandled rejection that propagates to the host. Specifically, if a Promise executor sets Error.name to a Symbol() and then accesses .stack, the internal V8 FormatStackTrace function attempts a Symbol.toString() operation, which throws a host-realm TypeError. Since the error originates within the executor and lacks a .catch() handler, it results in an unhandled rejection that terminates the host process.
Technical details include:
  • The localPromise wrapper in lib/setup-sandbox.js:38 fails to wrap the executor in a try-catch block.
  • The resetPromiseSpecies and overrides for .then() and .catch() in lib/setup-sandbox.js:165-230 do not intercept rejections originating from the executor itself.
  • Setting allowAsync: false does not mitigate the issue because the Promise constructor remains callable, and blocking .catch() ensures the rejection remains unhandled.
This can lead to a continuous denial-of-service loop where the host process crashes upon receiving a single request, potentially bypassing automatic restart policies.
Recommendations Update vm2 to version 3.11.0.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-248

Related Identifiers

BDU:2026-06909
CVE-2026-44001
GHSA-HW58-P9XV-2MJH

Affected Products

Vm2