CVE-2026-93606
Description
A flaw was found in vm2. An attacker running untrusted code within the sandbox can bypass isolation controls to achieve arbitrary code execution on the host system. This issue is caused by improper sanitization of host Promise objects, which allows sandboxed scripts to manipulate Promise constructor properties and obtain direct references to sensitive host-level objects. Consequently, an attacker can break out of the restricted sandbox environment and fully compromise the host.
Statement
This vulnerability is rated with Critical severity because it permits an attacker executing code within a sandboxed environment to bypass isolation boundaries and achieve full arbitrary code execution within the host process without requiring privileges or user interaction. In Red Hat environments where services evaluate user-supplied JavaScript, an untrusted actor can escape sandbox containment and gain control over the underlying application process. The total breakdown of containment controls and the potential for complete host-level compromise justify the Critical impact rating.
Mitigation
Until the fix is applied, do not expose host functions that return host-realm Promise objects to VM/NodeVM. Return only serialized primitives, or keep host work fully outside the sandbox.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9.8 | N/A | 10 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
RH vm2 sandbox-escape scoring: Scope Unchanged (host Node process is the same security authority). Matches CVE-2023-29017. CNA used S:C (10.0).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
