CVE-2026-47698

Received Received - Intake

Remote Code Execution in vm2 Sandbox

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and reach e.constructor.constructor for arbitrary host command execution. This issue is fixed in version 3.11.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-47698

Affected Vendors & Products

Vendor	Product	Version / Range
vm2	vm2	to 3.11.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-913	The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Attack-Flow Graph

Executive Summary

vm2 is a sandbox for Node.js. Before version 3.11.6, two files in vm2 failed to block a technique called stacked indirection using Function.prototype.call. This allowed sandboxed code to bypass security checks by modifying the prototype chain of host objects. The attacker could then access e.constructor.constructor to execute arbitrary commands on the host system.

Impact Analysis

If you use vm2 versions before 3.11.6, an attacker could run malicious code on your system by exploiting this sandbox escape. This could lead to data theft, system compromise, or unauthorized actions depending on the privileges of the Node.js process.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected vm2 versions may face compliance violations and potential fines.

Mitigation Strategies

Update vm2 to version 3.11.6 or later to address the vulnerability. If immediate update is not possible, restrict access to untrusted code execution environments and monitor for unusual activity.

Hi! I’m here to help you understand CVE-2026-47698. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70