CVE-2026-47131

Published: Jun 12, 2026Modified: Jun 13, 2026Deferred

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__"), Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__"), and Node.js's ERR_INVALID_ARG_TYPE Error, the host's TypeError constructor can be obtained, which allows the escape from the sandbox. This allows attackers to run arbitrary code. This issue has been patched in version 3.11.4.

Related CWEs

CWE-913

Improper Control of Dynamically-Managed Code Resources

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

References (4)

https://github.com/patriksimek/vm2/commit/27c525f4615e2b983f122e2bed327d810126f5c8

Source: security-advisories@github.com

https://github.com/patriksimek/vm2/releases/tag/v3.11.4

Source: security-advisories@github.com

https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg

Source: security-advisories@github.com

https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.