CRITICAL 9.8 GitHub
CVE-2026-47698
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
### Summary
VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.
### Details
The fix for https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg is insufficient and can be bypassed by replacing `indirectcall.call(dangerousmutator, ...)` with `indirectcall.call(indirectcall, dangerousmutator, ...)` since indirect calls are not seen as dangerous.
### PoC
Affected Products
- npm/vm2 <= 3.11.5
References
- https://github.com/advisories/GHSA-cfcw-xp6x-25gj
- https://github.com/patriksimek/vm2/security/advisories/GHSA-cfcw-xp6x-25gj
- https://github.com/patriksimek/vm2/releases/tag/3.11.6
- https://github.com/advisories/GHSA-cfcw-xp6x-25gj
This critical severity vulnerability with a CVSS score of 9.8 was published on 2026-08-17 via GitHub. Affected: npm/vm2 <= 3.11.5.
Risk Timeline
CVE Disclosed2026-08-17 · -1 days ago
Remediation Resources
Related Vulnerabilities
| CVE | Title | Severity | CVSS |
|---|---|---|---|
| CVE-2026-47686 | VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE | CRITICAL | 9.9 |
| CVE-2026-55157 | Token Optimizer MCP: OS command injection in smart_user via username in get-user | HIGH | 8.4 |
| CVE-2026-53728 | Medplum: Improper Validation of Redirect URI in External Auth Callback allows Au | HIGH | 7.1 |
| CVE-2026-55090 | Etherpad has stored XSS in HTML export via unescaped attribute-pool values | HIGH | — |
| CVE-2026-47683 | vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike | HIGH | — |
| CVE-2026-40345 | DeepmergeTS has stack exhaustion when merging recursive object graphs | HIGH | — |
vulnfeed aggregates 11030 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.