CVE-2026-47698
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and reach e.constructor.constructor for arbitrary host command execution. This issue is fixed in version 3.11.6.
Risk Assessment
Allows sandbox escape and arbitrary code execution on the host, potentially leading to full system compromise.
Recommendation
Upgrade vm2 to version 3.11.6 or later.
Original NVD description (English source)
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and reach e.constructor.constructor for arbitrary host command execution. This issue is fixed in version 3.11.6.