patriksimek vm2 up to 3.12.1 Construct Trap construct unusual condition

Summaryinfo

A vulnerability labeled as problematic has been found in patriksimek vm2 up to 3.12.1. This affects the function construct of the component Construct Trap. Executing a manipulation can lead to unusual condition. This vulnerability is registered as CVE-2026-100722. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in patriksimek vm2 up to 3.12.1. This vulnerability affects the function construct of the component Construct Trap. The manipulation with an unknown input leads to a unusual condition vulnerability. The CWE definition for the vulnerability is CWE-754. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. As an impact it is known to affect availability. CVE summarizes:

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to an uncaught exception that terminates the host process.

The advisory is available at github.com. This vulnerability was named CVE-2026-100722 since 09/26/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 3.12.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• patriksimek

Name

• vm2

Version

• 3.12.0
• 3.12.1

Website

• Product: https://github.com/patriksimek/vm2/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion