CVE-2026-47686 patriksimek CVE debrief

Who should care

Node.js developers and administrators using vm2 for sandboxing should assess exposure and prioritize upgrading to version 3.11.6 or later. This critical vulnerability in vm2 allows sandbox code to obtain powerful host objects, potentially leading to arbitrary host command execution. Defenders should prioritize verifying exposure in Node.js environments using vm2 versions prior to 3.11.6 and assessing the effectiveness of their current sandboxing and asset

Why it matters

CVE-2026-47686 is a critical vulnerability in vm2, an open-source vm/sandbox for Node.js. The issue allows sandbox code to obtain powerful host objects, potentially leading to arbitrary host command execution. Defenders should prioritize verifying exposure in Node.js environments using vm2 versions prior to 3.11.6 and assessing the effectiveness of their current sandboxing configurations.

• Potential for arbitrary host command execution in Node.js environments using vulnerable vm2 versions
• Exposure of powerful host objects like 'process' to sandbox code
• Bypass of sandboxing protections in vm2
• Verification of vm2 version and sandbox configuration required

Technical summary

The handleException() function in vm2's lib/setup-sandbox.js does not properly sanitize Error.cause, allowing sandbox code to access powerful host objects like 'process' from an embedder-exposed host function that throws an error with that object as its cause. This critical vulnerability in vm2, an open-source vm/sandbox for Node.js, allows sandbox code to obtain powerful host objects, potentially leading to arbitrary host command execution. The issue is fixed in version 3.11.6. Defenders should prioritize verifying exposure in Node.js environments using vm2 versions prior to 3.11.6 and assessing the effectiveness of their current sandboxing configurations.

Defensive priority

Defenders should prioritize verifying exposure in Node.js environments using vm2 versions prior to 3.11.6 and assessing the effectiveness of their current sandboxing configurations.

Recommended defensive actions

• Verify if Node.js environments in your organization use vm2 versions prior to 3.11.6
• Assess the effectiveness of current sandboxing configurations for vm2
• Upgrade vm2 to version 3.11.6 or later
• Review and update security advisories for vm2
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in vm2, an open-source vm/sandbox for Node.js. The issue is fixed in version 3.11.6. Evidence is limited to public CVE and NVD information. Defenders should verify exposure in Node.js environments using vm2 versions prior to 3.11.6 and assess the effectiveness of their current sandboxing configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.