CVE-2026-47698: vm2 Sandbox Breakout Vulnerability Allowing Remote Code Execution
Summary
CVE-2026-47698: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators. Affects vm2 versions < 3.11.6. Fixed in 3.11.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js package that provides a sandboxed environment for executing JavaScript code securely. It allows developers to run untrusted code without risking the security of the host system. However, due to its complex interaction with JavaScript's prototype system, vm2 is susceptible to vulnerabilities that can lead to security breaches.
Vulnerability Detail
The vm2 package contains a critical vulnerability that allows attackers to escape from its sandbox environment and execute arbitrary commands on the host system. This vulnerability arises from an insufficient fix for a previous issue, which can be bypassed by manipulating indirect calls to dangerous host prototype mutators. The potential ramifications include unauthorized access to the host system and execution of malicious code, leading to severe security risks.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.6
This is the first release that contains the fix.
npm install vm2@3.11.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using indirect calls to dangerous mutators within the vm2 sandbox. However, the best course of action is to update to the patched version as soon as possible.
Conclusion
The vm2 package has a critical vulnerability that allows for sandbox breakout and remote code execution. It is essential for users of this package to update to version 3.11.6 or later to protect their systems from potential attacks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
The vulnerability can lead to remote code execution, allowing attackers to run arbitrary commands on the host system, which poses a significant security risk.
Yes, a patch is available in version 3.11.6 of the vm2 package. It is recommended to update to this version to mitigate the risk.
If immediate updating is not possible, avoid using indirect calls to dangerous mutators in your code as a temporary workaround until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
