# CVE-2026-92956: vm2 sandbox escape via WebAssembly.compileStreaming

Source: https://junglewise.ai/threats/cve-2026-92956-vm2-sandbox-escape-via-webassembly-compilestreaming  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92956 · Severity: critical · CVSS 10 · Published 2026-09-17

vm2 is a JavaScript sandbox library used to safely execute untrusted code in isolation. Versions 3.10.1 through 3.11.6 contain a flaw that allows attackers running code in a default sandbox to escape and access the host Node.js process, including sensitive modules like the file system. An attacker with control over code executed in the sandbox can break out and execute arbitrary code on the host system.

Technologies: [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-92956 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92956 being exploited in the wild.

**How severe is CVE-2026-92956?** Critical severity, with a CVSS score of 10, published 17 September 2026.

**Which products and versions are affected?** vm2 (npm) >= 3.10.1, <= 3.11.6, SEMVER:introduced=3.10.1,fixed=3.11.7.

**Is there a fix for CVE-2026-92956?** Yes. vm2 (npm): upgrade to 3.11.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92956 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92956?** Check whether you run vm2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vm2 (npm): upgrade to 3.11.7 or later

  ```sh
  npm install vm2@3.11.7
  ```


## Technical details

The vulnerability is a sandbox escape triggered through WebAssembly.compileStreaming and WebAssembly.instantiateStreaming APIs on Node.js 26. These streaming functions can return a raw host-realm Promise (not proxied through vm2's security boundary) that rejects with a host-realm TypeError. By controlling Symbol.species via Promise.prototype.finally, sandbox code receives the host error object, traverses its constructor chain to reach the host Function constructor, and recovers the real host process object via hostError.constructor.constructor('return process')(). This bypasses vm2's Promise hardening which normally intercepts sandbox-realm Promise objects. The vulnerability requires only the ability to execute arbitrary JavaScript in a default new VM() sandbox; no NodeVM, require permissions, or unsafe host object injection is needed. Fix is available in version 3.11.7.

## Affected products

- vm2 vm2 3.10.1 through 3.11.6

## Identifiers

- CVE-2026-92956
- GHSA-wjwh-qqvp-g4p4

## Timeline

- 2026-08-24: disclosed
- 2026-09-17: advisory
- 2026: patched: Fix released in vm2 3.11.7

## References

- [https://github.com/patriksimek/vm2/security/advisories/GHSA-wjwh-qqvp-g4p4](https://github.com/patriksimek/vm2/security/advisories/GHSA-wjwh-qqvp-g4p4)
- [https://www.vulncheck.com/advisories/vm2-3.10.1-through-3.11.6-sandbox-escape-via-webassembly-compilestreaming](https://www.vulncheck.com/advisories/vm2-3.10.1-through-3.11.6-sandbox-escape-via-webassembly-compilestreaming)

## Related threats

- [vm2 NodeVM path bypass in custom resolution](https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-custom-resolution-bypasses-external-path-5d3a7272)
- [vm2 NodeVM zlib buffer pool information disclosure](https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-zlib-buffers-expose-pooled-host-memory-6007c734)
- [vm2 host Promise rejection denial of service in construct trap](https://junglewise.ai/threats/duplicate-advisory-vm2-host-promise-rejection-from-an-exposed-f7aba6ba)
- [vm2 sandbox escape via Buffer backing-store ownership bypass](https://junglewise.ai/threats/cve-2026-100723-vm2-before-3-12-2-does-not-apply-its-buffer-backing-store)
- [vm2 unhandled Promise rejection in construct trap](https://junglewise.ai/threats/cve-2026-100722-vm2-before-3-12-2-does-not-apply-host-side-promise-rejection)