CVSS 3.1
10.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCVE-2026-22709
Critical (10.0) in vm2 project vm2. EPSS 1.3% chance of exploitation in the next 30 days. Fixed in vm2 3.10.2.
vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-94, CWE-693, CWE-913
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vm2_project:vm2
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-99p7-6v5w-7xg8 | npm | vm2 | <3.10.2 | 3.10.2 |