vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods (Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled) still assimilate attacker-supplied thenables: native promise resolution performs PromiseResolveThenableJob and invokes the sandboxed code's then method in a microtask without passing through the patched then, so the async restriction is never applied. As a result, sandboxed script can schedule work that runs after VM.run() or NodeVM.run() has returned and outside the configured timeout, continuing to execute after the host believes execution is complete.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While
    localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's
    Promise static methods (Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled)
    still assimilate attacker-supplied thenables: native promise resolution performs PromiseResolveThenableJob
    and invokes the sandboxed code's then method in a microtask without passing through the patched then, so
    the async restriction is never applied. As a result, sandboxed script can schedule work that runs after
    VM.run() or NodeVM.run() has returned and outside the configured timeout, continuing to execute after the
    host believes execution is complete. (CVE-2026-92959)

ID	Name	Product	Family	Type	Severity
473550	Echo: vm2: security update to 3.11.8	Tenable Cloud Security	Echo Local Security Checks	Local	high
473550	Echo: vm2: security update to 3.11.8	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
473016	SCA: security update for vm2 (GHSA-f8gf-w286-fmq2)	Tenable Cloud Security	SCA Checks	Local	high
473016	SCA: security update for vm2 (GHSA-f8gf-w286-fmq2)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-92959

high

Tenable Plugins

high

high

high

high