{"id":"EUVD-2026-36448","enisaUuid":"334ef66b-352b-3924-915d-9181367a0ed7","description":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code execution in the host process when untrusted code is executed with async support on runtimes exposing WebAssembly JSPI (WebAssembly.promising / WebAssembly.Suspending). In the tested configuration, a JSPI-backed Promise can reach Promise.prototype.finally() in a way that bypasses the expected Promise-species hardening and exposes a host-originated rejection object to attacker-controlled species logic, breaking the sandbox boundary. This issue has been patched in version 3.11.4.","datePublished":"Jun 12, 2026, 2:17:22 PM","dateUpdated":"Jun 13, 2026, 3:56:00 AM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-6j2x-vhqr-qr7q\nhttps://github.com/patriksimek/vm2/commit/6915fa4d9bcebd47b9a4f39a1adc1aa94ef6ffc6\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.4\n","aliases":"CVE-2026-47210\nGHSA-6j2x-vhqr-qr7q\n","assigner":"GitHub_M","epss":1.72,"enisaIdProduct":[{"id":"85a91db4-0bc6-3235-b843-d0108b779ddf","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.4"}],"enisaIdVendor":[{"id":"5bc7e0c9-e19d-309c-9145-08b00862e0bf","vendor":{"name":"patriksimek"}}],"enisaIdVulnerability":[{"id":"ce8553ea-b59d-3939-906e-bb09b836bc94","vulnerability":{"id":"GHSA-6j2x-vhqr-qr7q","description":"vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass","datePublished":"May 29, 2026, 5:51:05 PM","dateUpdated":"Jun 12, 2026, 8:55:08 PM","baseScore":0.0,"references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-6j2x-vhqr-qr7q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47210\nhttps://github.com/patriksimek/vm2/commit/6915fa4d9bcebd47b9a4f39a1adc1aa94ef6ffc6\nhttps://github.com/patriksimek/vm2\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.4\n","enisa_id":"EUVD-2026-36448\n","aliases":"CVE-2026-47210\nGHSA-6j2x-vhqr-qr7q\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e0cd08d7-870d-3077-96a7-52a7e78384dc","vulnerability":{"id":"CVE-2026-47210","description":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code execution in the host process when untrusted code is executed with async support on runtimes exposing WebAssembly JSPI (WebAssembly.promising / WebAssembly.Suspending). In the tested configuration, a JSPI-backed Promise can reach Promise.prototype.finally() in a way that bypasses the expected Promise-species hardening and exposes a host-originated rejection object to attacker-controlled species logic, breaking the sandbox boundary. This issue has been patched in version 3.11.4.","datePublished":"Jun 12, 2026, 2:17:22 PM","dateUpdated":"Jun 13, 2026, 3:56:00 AM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-6j2x-vhqr-qr7q\nhttps://github.com/patriksimek/vm2/commit/6915fa4d9bcebd47b9a4f39a1adc1aa94ef6ffc6\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.4\n","enisa_id":"EUVD-2026-36448\n","assigner":"GitHub_M","epss":1.72,"dataProcessed":"Nov 1, 2026, 7:19:05 AM","vulnerabilityProduct":[{"id":"83e94d44-02f6-3268-8414-c2d3eddaa281","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.4"}],"vulnerabilityVendor":[{"id":"96e2aad7-09f3-3265-9db5-3bf301504546","vendor":{"name":"patriksimek"}}]}}],"enisaIdAdvisory":[{"id":"d54b537a-d776-3780-8923-36eda327372e","advisory":{"id":"RHSA-2026:36754","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.2 release.","summary":"Red Hat Developer Hub 1.10.2 has been released.","datePublished":"Jul 8, 2026, 1:07:12 PM","dateUpdated":"Oct 31, 2026, 3:41:14 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:36754\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36754.json\n","aliases":"CVE-2026-6322\nCVE-2026-6734\nCVE-2026-9277\nCVE-2026-9673\nCVE-2026-9697\nCVE-2026-12143\nCVE-2026-12151\nCVE-2026-24781\nCVE-2026-27136\nCVE-2026-39820\nCVE-2026-42338\nCVE-2026-42499\nCVE-2026-44486\nCVE-2026-44487\nCVE-2026-44488\nCVE-2026-44492\nCVE-2026-44494\nCVE-2026-44495\nCVE-2026-44496\nCVE-2026-45736\nCVE-2026-47131\nCVE-2026-47135\nCVE-2026-47137\nCVE-2026-47139\nCVE-2026-47140\nCVE-2026-47141\nCVE-2026-47208\nCVE-2026-47210\nCVE-2026-48779\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0f14fa1f-fa38-36ce-bf45-f89137f35d1b","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:d4208a03e389fe82e7da2d27c491251e6d43a0b473aa80d3e6a351c77582a92a_amd64","vendor":{"name":"Red Hat"}}},{"id":"5fac6ca8-8fe1-31d4-a002-db1289c2c19c","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:61883f5228095e3a3fd5b7daf60e29a5ffd053844f8661a2b5282a77c086dc02_amd64","vendor":{"name":"Red Hat"}}},{"id":"75062e24-95c7-30c4-99fa-d45cc08b8c8f","product":{"name":"registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:bea9305c453e377dfe6abf20076aec408efe2cbcf05f5a1c04c9b2d2f288bd65_amd64","vendor":{"name":"Red Hat"}}},{"id":"7e435575-3d3b-3b5e-8bc3-c3f04f8ca16f","product":{"name":"Red Hat Developer Hub 1.10","vendor":{"name":"Red Hat"}}},{"id":"96f302ed-b73f-381f-932a-b36797539266","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:0856143fa78dbbd74c1c068c75c265451698913608009f40600bb7c46928739b_amd64","vendor":{"name":"Red Hat"}}},{"id":"bf0c01af-6d82-3776-9fc4-6d8cfcfddb34","product":{"name":"registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:aacbef97f59305a91db44c3c92c34509027b3d2a4ece07716e6fe8b217dd5ee1_amd64","vendor":{"name":"Red Hat"}}}]}}]}