Skip to content

vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass

Critical severity GitHub Reviewed Published May 18, 2026 in patriksimek/vm2 • Updated May 29, 2026

No open alerts for this advisory

Give feedback on Dependabot alerts