# CVE-2026-92937: vm2 sandbox escape in Promise rejection handling

Source: https://junglewise.ai/threats/cve-2026-92937-vm2-sandbox-escape-in-promise-rejection-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92937 · Severity: critical · CVSS 10 · Published 2026-09-17

vm2 is a popular Node.js library that runs untrusted JavaScript in a sandboxed environment. A flaw in how it handles rejected Promises allows attackers to bypass the sandbox and execute arbitrary system commands with the privileges of the host Node.js process. This affects any application that exposes async operations to sandboxed code and could lead to complete system compromise.

Technologies: [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-92937 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92937 being exploited in the wild.

**How severe is CVE-2026-92937?** Critical severity, with a CVSS score of 10, published 17 September 2026.

**Which products and versions are affected?** vm2 (npm) = 3.11.6, SEMVER:introduced=3.11.6,fixed=3.11.7.

**Is there a fix for CVE-2026-92937?** Yes. vm2 (npm): upgrade to 3.11.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92937 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92937?** Check whether you run vm2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vm2 (npm): upgrade to 3.11.7 or later

  ```sh
  npm install vm2@3.11.7
  ```


## Technical details

The vulnerability is a sandbox escape in vm2's Promise rejection handler sanitisation logic. The bridge sanitiser at lib/bridge.js:1624 uses identity checks to determine whether to rebuild rejected Promise values before passing them to sandbox callbacks. However, when rejection handlers are registered via Function.prototype.call or .apply indirection (e.g., p.then.call(p, undefined, cb)), the intercepted target becomes the host Function.prototype.call itself rather than the Promise, bypassing the sanitiser. This allows raw host error objects with non-primitive own properties (e.g., err.detail = process) to reach sandbox code as fully functional proxies. No authentication or special privileges are required; the attacker need only submit malicious code to be evaluated. The fix is available in vm2 3.11.7, which properly sanitises all rejection paths.

## Affected products

- patriksimek vm2 3.11.6

## Identifiers

- CVE-2026-92937
- GHSA-647f-g98j-qq25

## Timeline

- 2026-09-17: disclosed
- 2026-08-24: patched: Fix released in version 3.11.7

## References

- [https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25](https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25)
- [https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply](https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply)

## Related threats

- [vm2 NodeVM path bypass in custom resolution](https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-custom-resolution-bypasses-external-path-5d3a7272)
- [vm2 NodeVM zlib buffer pool information disclosure](https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-zlib-buffers-expose-pooled-host-memory-6007c734)
- [vm2 host Promise rejection denial of service in construct trap](https://junglewise.ai/threats/duplicate-advisory-vm2-host-promise-rejection-from-an-exposed-f7aba6ba)
- [vm2 sandbox escape via Buffer backing-store ownership bypass](https://junglewise.ai/threats/cve-2026-100723-vm2-before-3-12-2-does-not-apply-its-buffer-backing-store)
- [vm2 unhandled Promise rejection in construct trap](https://junglewise.ai/threats/cve-2026-100722-vm2-before-3-12-2-does-not-apply-host-side-promise-rejection)