CVE-2026-47131

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47131
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47131.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47131
Aliases
Downstream
Published
2026-06-12T14:14:17.037Z
Modified
2026-07-08T08:13:35.750899556Z
Severity
  • 10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
vm2: Sandbox Escape
Details

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.lookupGetter, Buffer, "proto"), Buffer.call.call({}.lookupSetter, Buffer, "proto"), and Node.js's ERRINVALIDARG_TYPE Error, the host's TypeError constructor can be obtained, which allows the escape from the sandbox. This allows attackers to run arbitrary code. This issue has been patched in version 3.11.4.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47131.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-913"
    ]
}
References

Affected packages

Git / github.com/patriksimek/vm2

Affected ranges

Type
GIT
Repo
https://github.com/patriksimek/vm2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
27c525f4615e2b983f122e2bed327d810126f5c8
Fixed
27354d56563b0acb54eb9dd92edbc167612b9d4b
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.11.4"
        }
    ]
}

Affected versions

3.*
3.9.10
3.9.11
3.9.12
3.9.13
3.9.14
3.9.15
3.9.16
3.9.17
3.9.18
3.9.19
3.9.3
3.9.4
3.9.5
3.9.6
3.9.7
3.9.8
3.9.9
v3.*
v3.10.0
v3.10.1
v3.10.2
v3.10.3
v3.10.4
v3.10.5
v3.11.0
v3.11.1
v3.11.2
v3.11.3
v3.9.0
v3.9.1
v3.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47131.json"