Critical severity9.9GHSA Advisory· Published Aug 17, 2026· Updated Sep 9, 2026

CVE-2026-47686

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process from an embedder-exposed host function that throws an error with that object as its cause and then execute arbitrary host commands. This issue is fixed in version 3.11.6.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
vm2npm	< 3.11.6	3.11.6

Affected products

Patriksimek/Vm2GHSA
Range: <= 3.11.5

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-m283-3h24-438vghsaADVISORY
github.com/patriksimek/vm2/releases/tag/3.11.6nvdWEB
github.com/patriksimek/vm2/security/advisories/GHSA-m283-3h24-438vnvdWEB
github.com/patriksimek/vm2/commit/7e3faaf550f4ab975bf4cdde183fcec49b056d8envd

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000