CVE-2026-92956

Name of the Vulnerable Software and Affected Versions vm2 versions 3.10.1 through 3.11.6

Description A sandbox escape exists when running on Node.js 26. The issue occurs because WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object. By controlling Symbol.species via Promise.prototype.finally, sandbox code can obtain this raw host error, navigate from the host error constructor to the host Function constructor, and recover the host process object. This allows the attacker to gain host Node.js capabilities, such as access to host modules like fs, within the process running the sandbox. This escape is possible using a default new VM() sandbox and does not require NodeVM, require permissions, host object injection, or any unsafe configuration.

Recommendations Update to version 3.11.7.