CVE-2026-47686

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process from an embedder-exposed host function that throws an error with that object as its cause and then execute arbitrary host commands. This issue is fixed in version 3.11.6.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/patriksimek/vm2/commit/7e3faaf550f4ab975bf4cdde183fcec49b056d8e
https://github.com/patriksimek/vm2/releases/tag/3.11.6
https://github.com/patriksimek/vm2/security/advisories/GHSA-m283-3h24-438v

Configurations

No configuration.

History

23 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) vm2 es una vm/sandbox de código abierto para Node.js. Anteriormente a la 3.11.6, handleException() en lib/setup-sandbox.js sanitiza SuppressedError.error, SuppressedError.suppressed y AggregateError.errors, pero no sanitiza Error.cause, permitiendo que el código de la sandbox obtenga un objeto host potente como process de una función host expuesta por el incrustador que lanza un error con ese objeto como su causa y luego ejecutar comandos host arbitrarios. Este problema se ha solucionado en la versión 3.11.6.

Information

Published : 2026-08-17 21:16

Updated : 2026-10-23 16:10

NVD link : CVE-2026-47686

Mitre link : CVE-2026-47686

CVE.ORG link : CVE-2026-47686

JSON object : View

Products Affected

No product.

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2026-47686", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47686", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "patriksimek", "product": "vm2", "versions": [{"status": "affected", "version": "< 3.11.6"}]}]}], "published": "2026-08-17T21:16:45.507", "references": [{"url": "https://github.com/patriksimek/vm2/commit/7e3faaf550f4ab975bf4cdde183fcec49b056d8e", "source": "security-advisories@github.com"}, {"url": "https://github.com/patriksimek/vm2/releases/tag/3.11.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m283-3h24-438v", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process from an embedder-exposed host function that throws an error with that object as its cause and then execute arbitrary host commands. This issue is fixed in version 3.11.6."}, {"lang": "es", "value": "vm2 es una vm/sandbox de c\u00f3digo abierto para Node.js. Anteriormente a la 3.11.6, handleException() en lib/setup-sandbox.js sanitiza SuppressedError.error, SuppressedError.suppressed y AggregateError.errors, pero no sanitiza Error.cause, permitiendo que el c\u00f3digo de la sandbox obtenga un objeto host potente como process de una funci\u00f3n host expuesta por el incrustador que lanza un error con ese objeto como su causa y luego ejecutar comandos host arbitrarios. Este problema se ha solucionado en la versi\u00f3n 3.11.6."}], "lastModified": "2026-10-23T16:10:00.313", "sourceIdentifier": "security-advisories@github.com"}