CVE-2026-47131

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__"), Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__"), and Node.js's ERR_INVALID_ARG_TYPE Error, the host's TypeError constructor can be obtained, which allows the escape from the sandbox. This allows attackers to run arbitrary code. This issue has been patched in version 3.11.4.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/patriksimek/vm2/commit/27c525f4615e2b983f122e2bed327d810126f5c8
https://github.com/patriksimek/vm2/releases/tag/v3.11.4
https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg
https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) vm2 es una vm/sandbox de código abierto para Node.js. Antes de la versión 3.11.4, al combinar Buffer.call.call({}.__lookupGetter__, Buffer, ’__proto__’), Buffer.call.call({}.__lookupSetter__, Buffer, ’__proto__’), y el Error ERR_INVALID_ARG_TYPE de Node.js, se puede obtener el constructor TypeError del host, lo que permite el escape de la sandbox. Esto permite a los atacantes ejecutar código arbitrario. Este problema ha sido parcheado en la versión 3.11.4.

Information

Published : 2026-06-12 15:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-47131

Mitre link : CVE-2026-47131

CVE.ORG link : CVE-2026-47131

JSON object : View

Products Affected

No product.

CWE

CWE-913

Improper Control of Dynamically-Managed Code Resources

{"id": "CVE-2026-47131", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47131", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-12T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "patriksimek", "product": "vm2", "versions": [{"status": "affected", "version": "< 3.11.4"}]}]}], "published": "2026-06-12T15:16:27.870", "references": [{"url": "https://github.com/patriksimek/vm2/commit/27c525f4615e2b983f122e2bed327d810126f5c8", "source": "security-advisories@github.com"}, {"url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg", "source": "security-advisories@github.com"}, {"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-913"}]}], "descriptions": [{"lang": "en", "value": "vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer, \"__proto__\"), Buffer.call.call({}.__lookupSetter__, Buffer, \"__proto__\"), and Node.js's ERR_INVALID_ARG_TYPE Error, the host's TypeError constructor can be obtained, which allows the escape from the sandbox. This allows attackers to run arbitrary code. This issue has been patched in version 3.11.4."}, {"lang": "es", "value": "vm2 es una vm/sandbox de c\u00f3digo abierto para Node.js. Antes de la versi\u00f3n 3.11.4, al combinar Buffer.call.call({}.__lookupGetter__, Buffer, \u2019__proto__\u2019), Buffer.call.call({}.__lookupSetter__, Buffer, \u2019__proto__\u2019), y el Error ERR_INVALID_ARG_TYPE de Node.js, se puede obtener el constructor TypeError del host, lo que permite el escape de la sandbox. Esto permite a los atacantes ejecutar c\u00f3digo arbitrario. Este problema ha sido parcheado en la versi\u00f3n 3.11.4."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}