Find real vulnerabilities before they ship
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the onRejected callback in .then() and .catch() overrides and did not address the executor-to-unhandledRejection path. This vulnerability is fixed in 3.11.0.
Base Score
8.6| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| vm2(npm) | 0 | 3.11.0 | N/A |
| Base Score | 8.6 |
|---|---|
| Vector String | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
| Base Severity | High |
| Version | 3.1 |
| Attack Vector (AV) | NETWORK |
