https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 21:50:57 +0000 https://vulnerability.circl.lu/vuln/cve-2026-92944 <p><strong>Affected:</strong> patriksimek vm2</p> <p>vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2&#39;s wrapper protections due to a stale PromiseThenLookupChain protector in V8 14.6. Attackers can exploit this by creating an async function that returns a Promise with an attacker-controlled constructor Symbol.species, allowing them to reach the host Function constructor and process object for arbitrary code execution.</p> <p><strong>Affected:</strong> patriksimek vm2</p> <p>vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2&#39;s wrapper protections due to a stale PromiseThenLookupChain protector in V8 14.6. Attackers can exploit this by creating an async function that returns a Promise with an attacker-controlled constructor Symbol.species, allowing them to reach the host Function constructor and process object for arbitrary code execution.</p> https://vulnerability.circl.lu/vuln/cve-2026-92944 https://vulnerability.circl.lu/vuln/ghsa-27g9-p43v-cw3v <p><strong>Affected:</strong> npm: vm2</p> <p>## Reporter</p> <p>- Name or handle: `[YMsora]` - Report date: 2026-08-14</p> <p>## Summary</p> <p>The latest published vm2 release, **3.11.5**, and the current `main` branch are vulnerable to a sandbox escape when used on Node.js 26. An ordinary fulfilled Promise created by an async function can retain an attacker-controlled `constructor[Symbol.species]` across `Promise.prototype.finally()`.</p> <p>vm2 installs wrappers on the intrinsic `Promise.prototype.then` and `catch` methods. On Node.js 26 / V8 14.6, V8&#39;s `SetPrototypeProperties` path updates these existing data properties without invalidating the `PromiseThenLookupChain` protector. `Promise.prototype.finally()` subsequently trusts the stale protector and uses an internal `InvokeThen` fast path that calls the original native `then`, bypassing vm2&#39;s wrapper and its `resetPromiseSpecies(this)` hardening.</p> <p>The attacker-controlled species constructor therefore supplies the resolve and reject functions used by a native Promise reaction. A calibrated stack overflow at that native reaction boundary yields a raw host-realm `RangeError` to the attacker-controlled reject function. Its constructor chain reaches the host `Function` constructor and consequently the host `process` object.</p> <p>The attached proof is non-destructive: it reads only `process.version`. It does not execute commands, access files, or perform network requests.</p> <p>## Latest-version status</p> <p>Verified on 2026-08-14:</p> <p>- npm `latest`: `vm2@3.11.5` - `vm2@3.11.5` publication time: 2026-05-18T…</p> <p><strong>Affected:</strong> npm: vm2</p> <p>## Reporter</p> <p>- Name or handle: `[YMsora]` - Report date: 2026-08-14</p> <p>## Summary</p> <p>The latest published vm2 release, **3.11.5**, and the current `main` branch are vulnerable to a sandbox escape when used on Node.js 26. An ordinary fulfilled Promise created by an async function can retain an attacker-controlled `constructor[Symbol.species]` across `Promise.prototype.finally()`.</p> <p>vm2 installs wrappers on the intrinsic `Promise.prototype.then` and `catch` methods. On Node.js 26 / V8 14.6, V8&#39;s `SetPrototypeProperties` path updates these existing data properties without invalidating the `PromiseThenLookupChain` protector. `Promise.prototype.finally()` subsequently trusts the stale protector and uses an internal `InvokeThen` fast path that calls the original native `then`, bypassing vm2&#39;s wrapper and its `resetPromiseSpecies(this)` hardening.</p> <p>The attacker-controlled species constructor therefore supplies the resolve and reject functions used by a native Promise reaction. A calibrated stack overflow at that native reaction boundary yields a raw host-realm `RangeError` to the attacker-controlled reject function. Its constructor chain reaches the host `Function` constructor and consequently the host `process` object.</p> <p>The attached proof is non-destructive: it reads only `process.version`. It does not execute commands, access files, or perform network requests.</p> <p>## Latest-version status</p> <p>Verified on 2026-08-14:</p> <p>- npm `latest`: `vm2@3.11.5` - `vm2@3.11.5` publication time: 2026-05-18T…</p> https://vulnerability.circl.lu/vuln/ghsa-27g9-p43v-cw3v