Do Son 
TL;DR
The maintainers of vm2 patched three critical flaws on August 17, 2026. The most severe, CVE-2026-47686, scores a CVSS of 9.9 and enables a full vm2 sandbox escape. Its advisory includes a working proof-of-concept exploit that hijacks the host. All versions up to and including 3.11.5 are affected.
- Product: vm2 (npm)
- Vulnerabilities: 2 flaws (CVE-2026-47686, CVE-2026-47698)
- Highest severity: 9.9 (Critical · CVSSv3)
- Worst impact: Missing Error.cause Sanitization Enables Sandbox Escape to RCE
- Status: No confirmed exploitation yet; patches available
- Action: Update to 3.11.6 now
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-47686 | 9.9 | CWE-693 | 3.11.6 | Not exploited |
| CVE-2026-47698 | 9.8 | CWE-913 | 3.11.6 | Not exploited |
Why it matters
vm2 runs untrusted JavaScript inside a sandbox. Many code editors, automation tools, and AI agent frameworks depend on it. A sandbox escape turns that trust into a liability. As a result, attacker-controlled code inside the sandbox can reach the host and run commands.
The risk grows because the details and exploit code are now public. Each disclosed advisory publishes the mechanism openly. That transparency helps defenders, yet it also lowers the bar for attackers.
How the attack works
The headline vm2 sandbox escape abuses the ES2022 Error.cause property. The sandbox sanitizes some nested errors but overlooks .cause. When a host function throws an error that chains a host object, sandbox code can grab that reference. From there, it reaches host command execution.
The researcher who reported CVE-2026-47686 confirmed full remote code execution. The published Error.cause advisory notes the project’s own docs claimed this path was sanitized. The implementation did not match that claim.
Two more critical breaks
The second flaw, CVE-2026-47698 (CVSS 9.8), bypasses an earlier fix. It stacks indirect calls around dangerous prototype mutators to reach host code, as detailed in the proto mutators advisory. A third issue, tracked as GHSA-m5w8-4gq2-6f8x, exposes the os and dns builtins. Notably, dns.setServers lets sandbox code hijack the host’s DNS resolver. That turns the sandbox into a traffic-redirection tool, as the os and dns advisory explains.
Affected versions
All three flaws affect vm2 version 3.11.5 and earlier. The os and dns issue applies to NodeVM setups that allow all builtins through the wildcard pattern.
Exploitation status
Public proof-of-concept code exists for the Error.cause flaw within its advisory. However, researchers have not confirmed exploitation in the wild so far. Given the public detail, quick patching still matters.
Patch and mitigation steps
Update vm2 to version 3.11.6 without delay. The release fixes all three advisories at once. Check your dependency tree, since vm2 often arrives as a transitive dependency. If you cannot patch, treat any host that ran untrusted code through vm2 as at risk.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
