vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to an uncaught exception that terminates the host process.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct
    trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the
    adjacent construct path returns the result of Reflect.construct without the same sanitization. If an
    embedder exposes a constructable host function whose constructor returns a native rejected Promise, an
    untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host
    Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to
    an uncaught exception that terminates the host process. (CVE-2026-100722)

ID	Name	Product	Family	Type	Severity
473551	Echo: vm2: security update to 3.12.2	Tenable Cloud Security	Echo Local Security Checks	Local	high
473551	Echo: vm2: security update to 3.12.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
473011	SCA: security update for vm2 (GHSA-2v2p-6j97-cjg9)	Tenable Cloud Security	SCA Checks	Local	high
473011	SCA: security update for vm2 (GHSA-2v2p-6j97-cjg9)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-100722

high

Tenable Plugins

high

high

high

high