---
id: CVE-2026-92942
title: >-
  vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({
  timeout }) option on code executed outside the synchronous VM#run() call
summary: >-
  vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({
  timeout }) option on code executed outside the synchronous VM#run() call. The
  timeout only wraps the single call to _runScript() via doWithTimeout() in
  lib/vm.js, …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
  - CWE-1100
vendor: patriksimek
product: vm2
affected:
  - vm2 < 3.11.7
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:17:30.843'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92942'
references:
  - url: 'https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/vm2-before-3.11.7-timeout-bypass-via-finalizationregistry
    label: disclosure@vulncheck.com
  - url: 'https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92942.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-92942'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536038'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-92942'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92942'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-18T19:34:17.365666Z'
epss: 0.00488
epssPercentile: 0.39422
ingestedAt: '2026-09-17T14:19:30.985Z'
---

## Overview

vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call. The timeout only wraps the single call to _runScript() via doWithTimeout() in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodified (they are not among the hardened globals in lib/setup-sandbox.js). Sandboxed code can register a FinalizationRegistry cleanup callback against an object and then drop the only strong reference to it; vm.run() returns within the configured timeout, but when the V8 garbage collector later reclaims the object it invokes the sandboxed cleanup callback outside any vm2 timeout accounting. A busy loop in that callback blocks the host event loop for an unbounded period, resulting in denial of service. The time of invocation depends on the garbage collector (e.g. under memory pressure or with --expose-gc).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Developer Hub, Self-service automation portal 2 · no fix planned: Red Hat Developer Hub, Self-service automation portal 2 · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92942.json)