CVE-2026-47210

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code execution in the host process when untrusted code is executed with async support on runtimes exposing WebAssembly JSPI (WebAssembly.promising / WebAssembly.Suspending). In the tested configuration, a JSPI-backed Promise can reach Promise.prototype.finally() in a way that bypasses the expected Promise-species hardening and exposes a host-originated rejection object to attacker-controlled species logic, breaking the sandbox boundary. This issue has been patched in version 3.11.4.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/patriksimek/vm2/commit/6915fa4d9bcebd47b9a4f39a1adc1aa94ef6ffc6
https://github.com/patriksimek/vm2/releases/tag/v3.11.4
https://github.com/patriksimek/vm2/security/advisories/GHSA-6j2x-vhqr-qr7q
https://github.com/patriksimek/vm2/security/advisories/GHSA-6j2x-vhqr-qr7q

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) vm2 es una vm/sandbox de código abierto para Node.js. Antes de la versión 3.11.4, una vulnerabilidad de escape de sandbox en vm2 permite la ejecución de código arbitrario en el proceso anfitrión cuando se ejecuta código no confiable con soporte asíncrono en entornos de ejecución que exponen WebAssembly JSPI (WebAssembly.promising / WebAssembly.Suspending). En la configuración probada, una Promesa respaldada por JSPI puede alcanzar Promise.prototype.finally() de una manera que elude el endurecimiento esperado de las especies de Promesa y expone un objeto de rechazo originado en el anfitrión a la lógica de especies controlada por el atacante, rompiendo el límite de la sandbox. Este problema ha sido parcheado en la versión 3.11.4.

Information

Published : 2026-06-12 15:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-47210

Mitre link : CVE-2026-47210

CVE.ORG link : CVE-2026-47210

JSON object : View

Products Affected

No product.

CWE

CWE-913

Improper Control of Dynamically-Managed Code Resources

{"id": "CVE-2026-47210", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47210", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-12T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "patriksimek", "product": "vm2", "versions": [{"status": "affected", "version": "< 3.11.4"}]}]}], "published": "2026-06-12T15:16:29.030", "references": [{"url": "https://github.com/patriksimek/vm2/commit/6915fa4d9bcebd47b9a4f39a1adc1aa94ef6ffc6", "source": "security-advisories@github.com"}, {"url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-6j2x-vhqr-qr7q", "source": "security-advisories@github.com"}, {"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-6j2x-vhqr-qr7q", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-913"}]}], "descriptions": [{"lang": "en", "value": "vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code execution in the host process when untrusted code is executed with async support on runtimes exposing WebAssembly JSPI (WebAssembly.promising / WebAssembly.Suspending). In the tested configuration, a JSPI-backed Promise can reach Promise.prototype.finally() in a way that bypasses the expected Promise-species hardening and exposes a host-originated rejection object to attacker-controlled species logic, breaking the sandbox boundary. This issue has been patched in version 3.11.4."}, {"lang": "es", "value": "vm2 es una vm/sandbox de c\u00f3digo abierto para Node.js. Antes de la versi\u00f3n 3.11.4, una vulnerabilidad de escape de sandbox en vm2 permite la ejecuci\u00f3n de c\u00f3digo arbitrario en el proceso anfitri\u00f3n cuando se ejecuta c\u00f3digo no confiable con soporte as\u00edncrono en entornos de ejecuci\u00f3n que exponen WebAssembly JSPI (WebAssembly.promising / WebAssembly.Suspending). En la configuraci\u00f3n probada, una Promesa respaldada por JSPI puede alcanzar Promise.prototype.finally() de una manera que elude el endurecimiento esperado de las especies de Promesa y expone un objeto de rechazo originado en el anfitri\u00f3n a la l\u00f3gica de especies controlada por el atacante, rompiendo el l\u00edmite de la sandbox. Este problema ha sido parcheado en la versi\u00f3n 3.11.4."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}