Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck
CVE-2026-92956vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
Critical 10.0
In plain English
A critical-severity security flaw in vm2 from patriksimek. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling Symbol.species via Promise.prototype.finally, sandbox code receives that raw host error, walks from the host error constructor to the host Function constructor, and recovers the real host `process` object, gaining host Node.js capabilities (e.g. access to host modules such as fs) in the context of the process running the sandbox. No NodeVM, require permission, host object injection, or otherwise unsafe configuration is required. This is a bypass of the fix for GHSA-6j2x-vhqr-qr7q, which removed the JSPI entry points WebAssembly.promising and WebAssembly.Suspending. The issue is fixed in 3.11.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | vm2 | 3.11.7 | GHSA-wjwh-qqvp-g4p4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| patriksimek | vm2 | 3.10.1 – before 3.11.7 |
Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-wjwh-qqvp-g4p4) vendor-advisory
- VulnCheck Advisory: vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming third-party-advisory