# CVE-2026-45411: patriksimek vm2 sandbox escape via async generator yield* expression

Source: https://junglewise.ai/threats/cve-2026-45411-patriksimek-vm2-sandbox-escape-via-async-generator-yield  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-45411 · Severity: critical · CVSS 9.8 · Published 2026-05-13

vm2 is a Node.js sandbox used to safely execute untrusted code with restricted access to system modules. This vulnerability allows attackers to escape the sandbox and execute arbitrary commands on the host system by exploiting how async generators handle exceptions and thenable objects. An attacker who can run code inside a vm2 sandbox can break out and achieve full remote code execution on the underlying server.

Technologies: [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2), [Red Hat Self-service automation portal](https://junglewise.ai/threats/technologies/self-service-automation-portal). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-45411 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45411 being exploited in the wild.

**How severe is CVE-2026-45411?** Critical severity, with a CVSS score of 9.8, published 13 May 2026.

**Which products and versions are affected?** vm2 (npm) <= 3.11.2; Red Hat Self-service automation portal 2.

**Is there a fix for CVE-2026-45411?** A patch was published on 2026-05-11: Patch released in version 3.11.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45411 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45411?** Check whether you run vm2 (npm) or Red Hat Self-service automation portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in vm2's async generator implementation. An attacker can use the yield* expression inside an async generator to catch host exceptions. When the generator is closed using the return function with a thenable object (one with a .then method), exceptions thrown during the thenable resolution are caught by the runtime and passed to the yield* iterator. This allows the attacker to access host-realm objects and bypass sandbox isolation. The proof-of-concept demonstrates using this technique to access the process object and execute shell commands via child_process.execSync. The fix, released in version 3.11.3, wraps the async generator prototype methods (next, return, throw) to sanitize both iterator-result values and thenable arguments, preventing V8's promise handling from detecting user-supplied thenables that could bridge the sandbox boundary.

## Affected products

- npm vm2 <= 3.11.2

## Identifiers

- CVE-2026-45411
- GHSA-248r-7h7q-cr24

## Timeline

- 2026-05-14: disclosed: Vulnerability published
- 2026-05-11: patched: Patch released in version 3.11.3

## References

- [https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24](https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24)
- [https://github.com/patriksimek/vm2/commit/093494c0c3ef2390d2e56909f9d56e290e6f18b0](https://github.com/patriksimek/vm2/commit/093494c0c3ef2390d2e56909f9d56e290e6f18b0)
- [https://github.com/patriksimek/vm2](https://github.com/patriksimek/vm2)
- [https://github.com/patriksimek/vm2/releases/tag/v3.11.3](https://github.com/patriksimek/vm2/releases/tag/v3.11.3)

## Related threats

- [vm2 NodeVM path bypass in custom resolution](https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-custom-resolution-bypasses-external-path-5d3a7272)
- [vm2 NodeVM zlib buffer pool information disclosure](https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-zlib-buffers-expose-pooled-host-memory-6007c734)
- [vm2 host Promise rejection denial of service in construct trap](https://junglewise.ai/threats/duplicate-advisory-vm2-host-promise-rejection-from-an-exposed-f7aba6ba)
- [vm2 sandbox escape via Buffer backing-store ownership bypass](https://junglewise.ai/threats/cve-2026-100723-vm2-before-3-12-2-does-not-apply-its-buffer-backing-store)
- [vm2 unhandled Promise rejection in construct trap](https://junglewise.ai/threats/cve-2026-100722-vm2-before-3-12-2-does-not-apply-host-side-promise-rejection)