Protection mechanism failure in vm2 - CVE-2026-92959
Published: August 28, 2026 / Updated: September 18, 2026
Vulnerability identifier: #VU146046
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-92959
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service and bypass configured asynchronous execution restrictions.
The vulnerability exists due to protection mechanism failure in Promise static method handling in VM and NodeVM when processing attacker-controlled thenables with allowAsync: false. A remote user can supply a specially crafted thenable to continue sandboxed code execution after run() returns and cause a denial of service and bypass configured asynchronous execution restrictions.
The issue affects Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled, and code execution can occur outside the configured timeout.
Affected software
vm2
How to mitigate CVE-2026-92959
Install security update from vendor's website.
vm2 - update to 3.11.8