CVE-2026-92944

Name of the Vulnerable Software and Affected Versions vm2 versions 3.10.2 through 3.11.6

Description A sandbox escape exists on Node.js 26 where Promise.prototype.finally() bypasses wrapper protections caused by a stale PromiseThenLookupChain protector in V8 14.6. An attacker can exploit this by creating an async function that returns a Promise with a controlled Symbol.species constructor, enabling access to the host Function constructor and process object for arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.