CVE-2026-92954

Name of the Vulnerable Software and Affected Versions vm2 versions 3.10.0 through 3.11.7

Description Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary. While Promises created inside the sandbox are wrapped with a rejection-swallowing handler in lib/setup-sandbox.js, the bridge only installs host-side rejection sanitizers when sandbox code calls .then, .catch, or .finally. Consequently, code running in the sandbox can invoke a host function that returns a rejected Promise, such as events.once() exposed via the NodeVM events builtin or other embedder-provided Promise-returning APIs, and ignore the return value. This leaves the host Promise unhandled, triggering the default Node.js unhandled-rejection behavior which terminates the host process.

Recommendations Update vm2 to version 3.11.8.