Executive Summary

CVE-2026-47210 is a sandbox escape vulnerability in the vm2 library for Node.js versions prior to 3.11.4. It occurs when untrusted code runs with asynchronous support on runtimes exposing WebAssembly JSPI features (such as WebAssembly.promising and WebAssembly.Suspending).

The vulnerability arises because a JSPI-backed Promise can reach Promise.prototype.finally() in a way that bypasses the expected Promise-species hardening. This exposes a host-originated rejection object to attacker-controlled species logic, effectively breaking the sandbox boundary.

This flaw allows attackers to execute arbitrary code in the host process, compromising the security boundary that vm2 is supposed to enforce.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to arbitrary code execution in the host process running the vm2 sandbox.

• Attackers can execute arbitrary commands on the host system.
• They can read and write files, potentially accessing sensitive data.
• Data theft and complete service compromise are possible outcomes.

Overall, the vulnerability severely impacts confidentiality, integrity, and availability of the affected system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects vm2 versions prior to 3.11.4 when running untrusted code with async support on Node.js runtimes exposing WebAssembly JSPI features (WebAssembly.promising / WebAssembly.Suspending). Detection involves identifying if your environment uses a vulnerable vm2 version and if the Node.js runtime exposes these JSPI features.

You can check the installed vm2 version by running the following command in your project directory:

• npm list vm2

To detect if your Node.js runtime exposes the vulnerable WebAssembly JSPI features, you can run a Node.js script to check for the presence of WebAssembly.promising or WebAssembly.Suspending:

• node -e "console.log('WebAssembly.promising' in WebAssembly, 'WebAssembly.Suspending' in WebAssembly)"

If the output is 'true true' or either is true, your runtime exposes the vulnerable JSPI features.

Additionally, reviewing logs or monitoring for unusual Promise.prototype.finally() behavior or unexpected host process executions triggered by sandboxed code may help detect exploitation attempts, but no specific detection commands are provided.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade vm2 to version 3.11.4 or later, where this sandbox escape vulnerability has been patched.

The fix involves removing the WebAssembly.promising and WebAssembly.Suspending objects from the sandbox environment at startup, preventing untrusted code from accessing host-realm Promise prototypes and breaking the sandbox boundary.

If upgrading immediately is not possible, consider disabling or restricting the use of async code that relies on WebAssembly JSPI features within the sandbox, or avoid running untrusted code on Node.js 26+ runtimes that expose these features.

Review the updated documentation and attack reproduction scripts provided by the vm2 project to understand the attack flow and ensure your environment is protected accordingly.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in vm2 allows arbitrary code execution in the host process, leading to potential arbitrary command execution, file read/write, data theft, and complete service compromise.

Such impacts on confidentiality, integrity, and availability could lead to non-compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity.

Exploitation of this vulnerability could result in unauthorized access to personal or protected health information, violating data protection requirements and potentially causing regulatory penalties.

Useful 0 Not Useful 0