Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-92942— vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry

Quick assessment

Affected
patriksimek vm2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

vm2 版本 3.11.7 之前（受影响的版本为 <= 3.11.6）未在同步 VM#run() 调用之外执行的代码中强制执行 选项。该超时机制仅通过 中的 函数包裹对 的单次调用；同时， 和 未经修改地暴露给沙箱代码（它们并不在 中列出的强化全局变量列表之中）。 沙箱内的代码可以针对某个对象注册一个 清理回调，然后丢弃对该对象的唯一强引用；此时 会在配置的超时时间内返回，但当 V8 垃圾回收器后续重新回收该对象时，会在任何 vm2 超时统计范围之外触发沙箱中的清理回调。如果该回调中包含一个忙等待循环，则会阻塞宿主

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1219 · Remote Access Tools
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92942

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry
Source: CVE Program / CVE List V5
Vulnerability Description
vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call. The timeout only wraps the single call to _runScript() via doWithTimeout() in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodified (they are not among the hardened globals in lib/setup-sandbox.js). Sandboxed code can register a FinalizationRegistry cleanup callback against an object and then drop the only strong reference to it; vm.run() returns within the configured timeout, but when the V8 garbage collector later reclaims the object it invokes the sandboxed cleanup callback outside any vm2 timeout accounting. A busy loop in that callback blocks the host event loop for an unbounded period, resulting in denial of service. The time of invocation depends on the garbage collector (e.g. under memory pressure or with --expose-gc).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
patriksimek vm2 0 ~ 3.11.7 -

II. Public POCs for CVE-2026-92942

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92942

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-92942 (2)

Same Patch Batch · patriksimek · 2026-09-17 · 30 CVEs total

CVE-2026-92946 10.0 CRITICAL vm2 before 3.11.7 Remote Code Execution via require.external
CVE-2026-92947 10.0 CRITICAL vm2 before 3.11.7 Memory Disclosure via Buffer Pool
CVE-2026-92941 10.0 CRITICAL vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
CVE-2026-92960 10.0 CRITICAL vm2 before 3.11.6 Process-wide State Exposure via os and dns
CVE-2026-92940 10.0 CRITICAL vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent
CVE-2026-92955 10.0 CRITICAL vm2 before 3.11.8 Sandbox Escape via NodeVM
CVE-2026-92937 10.0 CRITICAL vm2 3.11.6 Remote Code Execution via Promise call/apply
CVE-2026-92953 10.0 CRITICAL vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
CVE-2026-92956 10.0 CRITICAL vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
CVE-2026-92957 9.9 CRITICAL vm2 before 3.11.7 Authentication Bypass via node: Prefix
CVE-2026-92939 9.9 CRITICAL vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine
CVE-2026-92938 9.9 CRITICAL vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite
CVE-2026-92951 9.9 CRITICAL vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
CVE-2026-92948 9.9 CRITICAL vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test
CVE-2026-92944 9.8 CRITICAL vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector
CVE-2026-92935 9.0 CRITICAL vm2 NodeVM Remote Code Execution via Array-Shaped Require
CVE-2026-92934 9.0 CRITICAL vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
CVE-2026-92954 8.6 HIGH vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise
CVE-2026-92950 8.6 HIGH vm2 before 3.11.7 Sandbox Escape via CLI require
CVE-2026-92958 8.5 HIGH vm2 before 3.11.7 Denylist Bypass via fs/promises

Showing top 20 of 30 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: vm2
Same vendor: patriksimek
Same weakness: CWE-400

V. Comments for CVE-2026-92942

No comments yet

Leave a comment