CVE-2026-92959: vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM

When allowAsync is set to false, vm2 is expected to reject attempts to run asynchronous code. Direct use of Promise.prototype.then is blocked, but Promise static methods still assimilate attacker-controlled thenables. Promise.resolve(thenable), Promise.all([thenable]), Promise.race([thenable]), Promise.any([thenable]), and Promise.allSettled([thenable]) can invoke the thenable’s then method in a microtask after VM.run() or NodeVM.run() has already returned.

This bypasses the documented async-execution restriction and runs outside the configured timeout, allowing sandboxed code to continue executing after the host believes execution is complete.

Confirmed variants:

• VM({allowAsync:false}).run('Promise.resolve(thenable)')
• VM({allowAsync:false}).run('Promise.all([thenable])')
• VM({allowAsync:false}).run('Promise.race([thenable])')
• VM({allowAsync:false}).run('Promise.any([thenable])')
• VM({allowAsync:false}).run('Promise.allSettled([thenable])')
• NodeVM({allowAsync:false}).run('Promise.resolve(thenable)')

Negative cases checked:

• Direct Promise.resolve(1).then(...) throws VMError: Async not available in both VM and NodeVM.
• NodeVM dangerous builtin exposure was reviewed separately and not implicated in this issue.