The vm2 library versions 3.10.1 through 3.11.6 contain a sandbox escape vulnerability exploitable on Node.js 26. The issue arises because WebAssembly.compileStreaming and WebAssembly.instantiateStreaming produce raw host-realm Promises that reject with host-realm error objects. By controlling Symbol.species via Promise.prototype.finally, sandboxed code can obtain the raw host error, traverse from the error constructor to the host Function constructor, and ultimately recover the real host process object. This grants the sandboxed code full access to host Node.js capabilities, such as the filesystem module, without requiring NodeVM, require permissions, or any unsafe configuration. This vulnerability bypasses a previous fix (GHSA-6j2x-vhqr-qr7q) that removed certain JSPI entry points. The issue is resolved in vm2 version 3.11.7.

Exploitation of this vulnerability allows an attacker running code inside a vm2 sandbox to escape the sandbox and gain full access to the host Node.js process. This includes access to sensitive host modules like 'fs', enabling arbitrary code execution and potentially full system compromise. The vulnerability requires no user interaction or elevated privileges and is remotely exploitable in environments running affected vm2 versions on Node.js 26.

Upgrade vm2 to version 3.11.7 or later, where this vulnerability is fixed. No other mitigations are indicated or effective since the vulnerability does not require unsafe configurations or permissions. Patch status is confirmed by the vendor advisory stating the fix is in 3.11.7.