CVE-2026-47210

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.4

Description A sandbox escape allows arbitrary code execution in the host process when untrusted code is executed with async support on runtimes exposing WebAssembly JSPI (WebAssembly JavaScript Promise Integration), specifically WebAssembly.promising and WebAssembly.Suspending. A JSPI-backed Promise can reach the Promise.prototype.finally() function in a manner that bypasses Promise-species hardening. This exposes a host-originated rejection object to attacker-controlled species logic, breaking the sandbox boundary. In certain environments, the rejection object's constructor chain can be used to access the host process object, leading to full system compromise, including arbitrary command execution and unauthorized file access.

Recommendations Update to version 3.11.4.