CVE-2026-47131 | THREATINT

Description

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__"), Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__"), and Node.js's ERR_INVALID_ARG_TYPE Error, the host's TypeError constructor can be obtained, which allows the escape from the sandbox. This allows attackers to run arbitrary code. This issue has been patched in version 3.11.4.

PUBLISHED Reserved 2026-05-18 | Published 2026-06-12 | Updated 2026-06-13 | Assigner GitHub_M

CRITICAL: 10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-913: Improper Control of Dynamically-Managed Code Resources

Product status

< 3.11.4

affected

References

github.com/...ek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg exploit

github.com/...ek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg

github.com/...ommit/27c525f4615e2b983f122e2bed327d810126f5c8

github.com/patriksimek/vm2/releases/tag/v3.11.4

cve.org (CVE-2026-47131)

nvd.nist.gov (CVE-2026-47131)

Download JSON