CVE-2026-92956
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
There is a sandbox escape in vm2 3.11.5 / current HEAD when it is used on Node.js 26. The issue is reachable from a default new VM() sandbox. No NodeVM, require permission, host object injection, or intentionally unsafe configuration is required.
- No known exploitation
- Severity
- Critical, CVSS 10.0 (v3.1)
- EPSS
- 0.59% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vm2 (npm) >= 3.10.1, <= 3.11.6, fixed in 3.11.7 · GHSA-wjwh-qqvp-g4p4