Protection mechanism failure in vm2 - #VU146046
Published: August 28, 2026
Vulnerability identifier: #VU146046
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service and bypass configured asynchronous execution restrictions.
The vulnerability exists due to protection mechanism failure in Promise static method handling in VM and NodeVM when processing attacker-controlled thenables with allowAsync: false. A remote user can supply a specially crafted thenable to continue sandboxed code execution after run() returns and cause a denial of service and bypass configured asynchronous execution restrictions.
The issue affects Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled, and code execution can occur outside the configured timeout.
Affected software
vm2
Remediation
Install security update from vendor's website.
vm2 - update to 3.11.8