Back to overview

CVE-2026-22709

CRITICAL
9.8
CVSS 3.1
Description
vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.

Metadata

CVE ID
CVE-2026-22709
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-01-08 19:23 UTC
Published
2026-01-26 21:32 UTC
Last updated
2026-01-27 21:42 UTC
Primary CWE
CWE-94
CWE-94: Improper Control of Generation of Code ('Code Inject…
Vendor / Product
patriksimek / vm2
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
patriksimek vm2 — < 3.10.2
Weakness (CWE)
CWESourceDescription
CWE-693 cna CWE-693: Protection Mechanism Failure
CWE-913 cna CWE-913: Improper Control of Dynamically-Managed Code Resources
CWE-94 cna CWE-94: Improper Control of Generation of Code ('Code Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References (3)
Back to overview