vm2 3.11.6 Remote Code Execution via Promise call/apply

Description

vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when deciding whether to rebuild/sanitise a rejected host Promise value. Registering the rejection handler through Function.prototype.call or .apply indirection (e.g., p.then.call(p, undefined, cb)) makes the intercepted target host Function.prototype.call, so the sanitiser never runs and the raw host error reaches sandbox code with its own properties intact. If an embedder exposes a host-realm Promise to the sandbox (an async host function bridged via the sandbox option, or a NodeVM external module's async method) and that Promise rejects with an Error carrying a non-primitive own property referencing a host object (for example err.detail = process), untrusted code in the sandbox obtains a fully functional proxy to that host object and can execute arbitrary commands with the privileges of the host process (e.g., e.detail.mainModule.require('child_process').execSync(...)). The direct p.then(undefined, cb), bind, and Reflect.apply forms are correctly sanitised. Fixed in vm2 3.11.7.

Scores

EPSS (exploitation in 30 days)

1.0% · top 36% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 10.0.

Weakness

• CWE-94: Improper Control of Generation of Code ('Code Injection') (opens in a new tab)All about CWE-94 and its CVEs

Affected products

• patriksimek · vm2

  • affected 3.11.6 – < 3.11.7
  • unaffected 3.11.7

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• npmvm2GHSA-647f-g98j-qq25 (opens in a new tab)

References (2)

• GitHub Security Advisory (GHSA-647f-g98j-qq25) (opens in a new tab)vendor-advisoryexploit
• VulnCheck Advisory: vm2 3.11.6 Remote Code Execution via Promise call/apply (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-647f-g98j-qq25 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-92937](https://trackcve.app/badge/CVE-2026-92937.svg)](https://trackcve.app/cve/CVE-2026-92937)

Record last updated 18 Sept 2026, 19:25 UTC.