EUVD-2026-30071Published

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection p…

Exact source revision recorded 3 Nov 2026 08:10:28 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

euvd · EUVD-2026-30071

Published

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the onRejected callback in .then() and .catch() overrides and did not address the executor-to-unhandledRejection path. This vulnerability is fixed in 3.11.0.

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: May 13, 2026, 5:29:00 PM

dateUpdated: Sep 7, 2026, 12:05:03 PM

1 related source bulletins · separate from aliases

RHSA-2026:50850: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update

CVE-2026-9277 · CVE-2026-43997 · CVE-2026-43998 · CVE-2026-43999 · CVE-2026-44000 · CVE-2026-44001 · CVE-2026-44002 · CVE-2026-44003 · CVE-2026-44004 · CVE-2026-44005 · CVE-2026-44006 · CVE-2026-44007 · CVE-2026-44008 · CVE-2026-44009 · CVE-2026-45411 · CVE-2026-47131 · CVE-2026-47135 · CVE-2026-47137 · CVE-2026-47139 · CVE-2026-47140 · CVE-2026-47141 · CVE-2026-47209 · CVE-2026-48068 · CVE-2026-48801 · CVE-2026-59877

Source published: May 13, 2026, 5:29:00 PM (timezone not stated)
Source modified: Sep 7, 2026, 12:05:03 PM (timezone not stated)
Observed here: 3 Nov 2026 08:10:28 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H