Skip to main content

Uncaught Exception

CVE-2026-44001

Low
0/10

Summary

A sandbox escape vulnerability in vm2 prior to 3.11.0 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the `onRejected` callback in `.then()` and `.catch()` overrides and did not address the executor-to-unhandledRejection path.

  • LOW
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-248 - Uncaught Exception

An exception is thrown from a function, but it is not caught.

References

Advisory Timeline

  • Published