vm2 Promise species sandbox escape leading to host command execution

CVE-2026-24120 is a critical sandbox escape vulnerability in the vm2 Node.js sandbox library. The issue affects vm2 versions prior to 3.10.5 and is described as an incomplete fix bypass for CVE-2023-37466. The prior mitigation attempted to sanitize Promise species handling via a resetPromiseSpecies mechanism, but that protection can be neutralized because attacker-controlled code running inside the sandbox can overwrite Object.defineProperty. After disabling the intended sanitization, an attacker can abuse the species property of Promise objects so that Promise chaining uses an attacker-controlled constructor. The published exploit path causes a host-realm TypeError during stack formatting and then uses the leaked host-side error object to traverse the constructor chain and recover the host Function constructor. From there, the attacker can access process and invoke child_process.execSync() to execute arbitrary operating system commands on the underlying host. In practical terms, untrusted JavaScript evaluated inside vm2 can break out of the sandbox boundary and achieve host-level code execution.