Improper Control of Dynamically-Managed Code Resources in vm2 - CVE-2026-47210
Published: May 18, 2026
Vulnerability identifier: #VU131735
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-47210
CWE-ID: CWE-913
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of dynamically-managed code resources in Promise.prototype.finally() species handling when executing untrusted code with async support on runtimes exposing WebAssembly JSPI. A remote attacker can trigger a JSPI-backed Promise path that exposes a host-originated rejection object to attacker-controlled species logic to execute arbitrary code.
Only environments exposing WebAssembly.promising or WebAssembly.Suspending are affected, and the issue breaks the sandbox boundary by exposing access to host process objects.
Affected software
vm2
How to mitigate CVE-2026-47210
Install security update from vendor's website.
vm2 - update to 3.11.4