CVE-2026-92959 vm2 before 3.11.8 allowAsync Bypass via Promise Thenable
Attacker bypasses async restrictions in vm2 sandbox to execute code after timeout, risking resource exhaustion or unauthorized execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92959?
CVE-2026-92959 is a high-severity vulnerability in patriksimek vm2, published on 17 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods (Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled) still assimilate attacker-supplied thenables: native promise resolution performs PromiseResolveThenableJob and invokes the sandboxed code's then method in a microtask without passing through the patched then, so the async restriction is never applied. As a result, sandboxed script can schedule work that runs after VM.run() or NodeVM.run() has returned and outside the configured timeout, continuing to execute after the host believes execution is complete.
Weakness: CWE-693
Which versions are affected by CVE-2026-92959?
2 open source packages ship an affected version, including vm2.
| Package | Affected | Fixed in |
|---|---|---|
vm2 npm | All versions | 3.11.8 |
vm2 npm | All versions | 3.11.8 |
How do I fix CVE-2026-92959?
Upgrade vm2 to 3.11.8 or later.
Is CVE-2026-92959 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92959 exists.
Sources
Also known as CLEANSTART-2026-WX83139, ECHO-2f77-0a3f-c878, GHSA-f8gf-w286-fmq2, MINI-wf8x-hcvr-ff7x, ROOT-APP-NPM-CVE-2026-92959.