9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47210

CVE-2026-47210: vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code execution in the host process when untrusted code is executed with async support on runtimes exposing WebAssembly JSPI (WebAssembly.promising / WebAssembly.Suspending). In the tested configuration, a JSPI-backed Promise can reach Promise.prototype.finally() in a way that bypasses the expected Promise-species hardening and exposes a host-originated rejection object to attacker-controlled species logic, breaking the sandbox boundary. This issue has been patched in version 3.11.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47210

CVE-2026-47210:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vm2	npm	<= 3.11.3	3.11.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a sandbox escape in vm2 caused by the incomplete setup of the sandboxed environment. The root cause is the failure to remove two powerful, host-provided functions, WebAssembly.promising and WebAssembly.Suspending, from the global scope of the sandbox. These functions are part of the experimental WebAssembly JavaScript Promise Integration (JSPI) API.

The VM.constructor is the function responsible for creating the sandbox. It was vulnerable because it did not blacklist these functions, leaving them accessible to any code executed within the sandbox. An attacker can craft JavaScript code that uses these functions to create a special type of Promise. This Promise's prototype chain links directly to the host's Promise.prototype, bypassing all of vm2's proxy-based security wrappers and Promise-related hardening.

The VM.run method is the function that executes this malicious code inside the improperly configured sandbox. When the specially crafted Promise rejects, it does so with an error object originating from the host environment. Because the security wrappers were bypassed, the attacker's code receives the raw host error object, allowing it to access its constructor (Function) and ultimately the host's process object, leading to arbitrary code execution on the host machine.

The patch addresses the vulnerability by modifying the sandbox setup script (lib/setup-sandbox.js), which is executed during the VM's construction. It adds logic to explicitly delete WebAssembly.promising and WebAssembly.Suspending from the WebAssembly object within the sandbox, thus closing the hole.

Vulnerable functions

VM.constructor

lib/main.js

The `VM` constructor is responsible for creating and initializing the sandbox environment. It was vulnerable because it failed to remove the dangerous `WebAssembly.promising` and `WebAssembly.Suspending` functions from the sandboxed global scope. This omission allowed code running inside the sandbox to access these host functions and use them to bypass security controls.

VM.run

lib/main.js

This function is the primary entry point for executing untrusted JavaScript code within the vm2 sandbox. While the function's own code was not changed, it is the vehicle for the exploit. It processes the malicious input (the script) and executes it within the vulnerable environment created by the `VM` constructor. During an exploit, `VM.run` would be at the top of the call stack for the sandboxed code's execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.