Vulnerability Description
vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods (Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled) still assimilate attacker-supplied thenables: native promise resolution performs PromiseResolveThenableJob and invokes the sandboxed code's then method in a microtask without passing through the patched then, so the async restriction is never applied. As a result, sandboxed script can schedule work that runs after VM.run() or NodeVM.run() has returned and outside the configured timeout, continuing to execute after the host believes execution is complete.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/patriksimek/vm2/security/advisories/GHSA-f8gf-w286-fmq2
- https://www.vulncheck.com/advisories/vm2-before-3.11.8-allowasync-bypass-via-pro
FAQ
What is CVE-2026-92959?
CVE-2026-92959 is a vulnerability with a CVSS score of 7.1 (HIGH). vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Pr...
How severe is CVE-2026-92959?
CVE-2026-92959 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92959?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.