[ CVE-2026-92959 · Published 17 Sep 2026 ]
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
[ Description ]Official description
vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods (Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled) still assimilate attacker-supplied thenables: native promise resolution performs PromiseResolveThenableJob and invokes the sandboxed code's then method in a microtask without passing through the patched then, so the async restriction is never applied. As a result, sandboxed script can schedule work that runs after VM.run() or NodeVM.run() has returned and outside the configured timeout, continuing to execute after the host believes execution is complete.
[ Fixes ]Fixes and patches
- vm2 3.11.8Fixed version · GitHub Advisories · npm package vm2: upgrade to 3.11.8 or later (affected <= 3.11.7)
[ Packages ]Affected open-source packages
- vm2 npmAffected <= 3.11.7 · fixed in 3.11.8 · GHSA-f8gf-w286-fmq2