CVE-2026-47208
Critical · 10.0CVSS
10.0
EPSS
0.8%
Published
Jun 12, 2026
CISA due date
—
The record
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | vm2 | 0 | 3.11.4 |
Related vulnerabilities
- GHSA-76w7-j9cq-rx2j vm2 is Vulnerable to Sandbox Breakout Through Promise Species Same vulnerability
- CVE-2026-47210 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47209 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47139 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47135 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47137 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47141 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47140 vm2 is an open source vm/sandbox for Node.js. Also affects vm2