Sandbox escape in vm2 Promise callback sanitization

CVE-2026-22709 is a critical sandbox escape vulnerability in the vm2 Node.js sandbox library. In vm2 prior to 3.10.2, Promise callback sanitization can be bypassed because vm2 sanitizes callbacks on its local Promise handling path but does not correctly sanitize the global Promise path used by async functions. Specifically, in lib/setup-sandbox.js, localPromise.prototype.then is sanitized, while globalPromise.prototype.then/.catch handling is insufficient; async functions return globalPromise objects, creating a path where attacker-controlled callbacks can receive unsanitized host objects. Supporting analysis also indicates the vulnerable implementation used Function.prototype.call in global Promise handler paths, which could be intercepted by attacker-controlled code; the fix replaced this with Reflect.apply. Successful exploitation allows code running inside the vm2 sandbox to break isolation, recover host-realm objects, reach the Function constructor, and execute arbitrary code in the underlying Node.js host environment.