CVE-2026-93606 Overview
CVE-2026-93606 is a sandbox escape in the vm2 npm package affecting versions 3.12.0 and earlier. The flaw resides in the bridge's Promise rejection sanitizer, which fails to neutralize host-realm Promises returned by embedder-exposed APIs. Sandboxed code can overwrite p.constructor[Symbol.species] on a host Promise and invoke p.then() without an onRejected handler. This triggers V8's internal Thrower, which re-throws the raw host rejection value into an attacker-controlled closure. The result is an unsanitized bridge proxy of the host object delivered to sandboxed code, bypassing handleException and hostPromiseSanitizeReject. The issue is fixed in version 3.12.1.
Critical Impact
When the rejection value is host-pivotable such as the Node.js process object, attackers achieve arbitrary code execution on the host from within the sandbox.
Affected Products
- vm2 npm package versions 3.12.0 and earlier
- Node.js applications embedding vm2VM or NodeVM classes
- Embedders exposing host APIs that return host-realm Promises to sandboxed code
Discovery Timeline
- 2026-09-18 - CVE-2026-93606 published to NVD
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-93606
Vulnerability Analysis
The vulnerability arises in lib/bridge.js within the functions hostPromiseSanitizeReject, makeSanitizedPromiseCallback, and normalizeHostPromiseCallbacks. These routines wrap then and catch rejection slots only when those slots contain a function value. When no onRejected handler is provided, V8 substitutes its internal Thrower, which is not a function reference the sanitizer can detect or wrap. This gap allows unsanitized host rejection values to cross the sandbox boundary.
The secondary defense, sandbox-side Symbol.species and .then neutralization, is installed only on the sandbox intrinsic Promise.prototype. Host-realm Promises returned by embedder APIs use the host Promise.prototype and therefore never receive this protection. Sandboxed code can freely reassign p.constructor[Symbol.species] on a host Promise.
Root Cause
The root cause is an improper protection mechanism [CWE-693]. The bridge assumes rejection sanitization is sufficient when handler slots hold functions, but V8's Thrower substitution path is not covered. Combined with the missing host-side species neutralization, sandboxed code controls the constructor chain used by host Promise chaining.
Attack Vector
An attacker running code inside a vm2 sandbox targets any embedder-exposed API returning a host Promise. The attacker overwrites p.constructor[Symbol.species] with a controlled subclass, then calls p.then() without an onRejected argument. V8's internal Thrower re-throws the raw host rejection value into a resolve or reject closure captured by the attacker's species constructor. The captured value is a fully functional bridge proxy of the host object. If the host exposes a pivot such as process, the attacker calls process.mainModule.require('child_process').execSync() to execute arbitrary commands on the host system. See the GitHub Security Advisory GHSA-6454 for full technical detail.
Detection Methods for CVE-2026-93606
Indicators of Compromise
- Unexpected child process spawns originating from Node.js processes hosting vm2 sandboxes, especially shells or scripting interpreters
- Outbound network connections from Node.js processes to attacker-controlled infrastructure following untrusted script evaluation
- File system writes or reads outside the sandbox's expected working directory by the embedding Node.js process
Detection Strategies
- Inventory installed vm2 versions across Node.js services using npm ls vm2 and flag any version at or below 3.12.0
- Search application code for host APIs exposed to NodeVM or VM instances that return Promises to sandboxed code
- Monitor runtime behavior of Node.js processes for deviations from baseline process, network, and file activity after sandbox evaluation
Monitoring Recommendations
- Enable process lineage logging on hosts running Node.js services and alert on unexpected child processes of the Node runtime
- Ingest Node.js application logs into a centralized analytics platform and correlate sandbox invocations with subsequent system activity
- Track dependency manifests in CI pipelines and fail builds that pin vulnerable vm2 versions
How to Mitigate CVE-2026-93606
Immediate Actions Required
- Upgrade vm2 to version 3.12.1 or later across all Node.js applications immediately
- Audit every host API exposed to sandboxed code and identify any function returning a host-realm Promise
- Treat any environment running vulnerable vm2 versions with untrusted input as potentially compromised and investigate host activity
Patch Information
The vulnerability is fixed in vm2 version 3.12.1. The patch addresses the missing sanitization of the V8 Thrower path and closes the host-side Symbol.species neutralization gap. Refer to the VulnCheck Advisory for vm2 and the GitHub Security Advisory GHSA-6454 for full remediation guidance. Note that the vm2 project is deprecated; consider migrating to isolated-vm or a comparable isolation boundary for long-term risk reduction.
Workarounds
- Remove any embedder-exposed host APIs that return host-realm Promises to sandboxed code until upgrade is complete
- Wrap host Promise-returning APIs so they resolve or reject with primitive values only, never host object references
- Restrict the Node.js process running vm2 with OS-level sandboxing such as seccomp, AppArmor, or containers with minimal capabilities
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.