Vulnerability Description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.4.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/patriksimek/vm2/commit/a462655009669c3124ee39498121651597529e
- https://github.com/patriksimek/vm2/releases/tag/v3.11.4
- https://github.com/patriksimek/vm2/security/advisories/GHSA-76w7-j9cq-rx2j
- https://github.com/patriksimek/vm2/security/advisories/GHSA-76w7-j9cq-rx2j
FAQ
What is CVE-2026-47208?
CVE-2026-47208 is a vulnerability with a CVSS score of 10.0 (CRITICAL). vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and ...
How severe is CVE-2026-47208?
CVE-2026-47208 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-47208?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.