CVE-2026-47686 Overview
CVE-2026-47686 is a sandbox escape vulnerability in vm2, an open source virtual machine and sandbox library for Node.js. The flaw exists in the handleException() function within lib/setup-sandbox.js. The function sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors, but fails to sanitize Error.cause. Sandboxed code can obtain a reference to a host object such as process through an embedder-exposed host function that throws an error with that object attached as its cause. The attacker then executes arbitrary host commands outside the sandbox boundary. The issue is fixed in vm2 version 3.11.6.
Critical Impact
Authenticated sandbox code can escape the vm2 boundary and execute arbitrary commands on the host, breaking the security boundary the library exists to enforce.
Affected Products
- vm2 versions prior to 3.11.6
- Node.js applications embedding vm2 as an untrusted code sandbox
- Downstream libraries and services that bundle vulnerable vm2 releases
Discovery Timeline
- 2026-08-17 - CVE-2026-47686 published to the National Vulnerability Database
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-47686
Vulnerability Analysis
vm2 enforces a security boundary between untrusted guest code and the Node.js host by proxying and sanitizing objects that cross the sandbox edge. Exceptions are a well-known escape channel because a thrown error can carry references to arbitrary host objects. The handleException() routine in lib/setup-sandbox.js was designed to strip host references from error properties before the sandbox observes them.
The sanitization list was incomplete. Guest code catching an exception from an embedder-exposed host function can read err.cause and receive an unsanitized reference to a privileged host object such as process. From that reference, the guest reaches process.mainModule.require('child_process') or equivalent primitives and executes arbitrary commands with the privileges of the host Node.js process. This maps to [CWE-693: Protection Mechanism Failure].
Root Cause
The root cause is an incomplete allowlist in the exception sanitization logic. handleException() explicitly handled SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors, but did not include the standardized Error.cause property introduced in ECMAScript 2022. Any host object attached via cause traversed the sandbox boundary intact.
Attack Vector
Exploitation requires the ability to submit code into a vm2 sandbox and the existence of an embedder-supplied host function reachable from the sandbox. The attacker calls the host function in a way that triggers a thrown error whose cause is a host object. The guest catches the error, reads cause, and uses the resulting reference to reach the host require graph and spawn processes. The attack is fully remote when the sandbox is exposed through a network-facing service such as a code-execution or template-rendering endpoint.
The vm2 library is no longer maintained upstream, so embedders should treat this class of bypass as expected behavior for untrusted input and migrate to alternative isolation primitives. See the GitHub Security Advisory GHSA-m283-3h24-438v for the maintainer's technical write-up.
Detection Methods for CVE-2026-47686
Indicators of Compromise
- Node.js processes spawning unexpected child processes such as sh, bash, cmd.exe, or powershell.exe from a service that embeds vm2.
- Outbound network connections initiated by the Node.js host immediately after sandbox execution requests.
- File writes or reads outside the application working directory originating from the vm2 host process.
- Presence of vm2 versions prior to 3.11.6 in package-lock.json, yarn.lock, or software bill of materials output.
Detection Strategies
- Inventory dependencies with npm ls vm2 or SBOM tooling and flag any version below 3.11.6.
- Monitor for child_process.spawn, exec, or fork calls originating from services that only intend to evaluate user-supplied expressions.
- Alert on guest code containing Error.cause access patterns combined with .constructor.constructor or mainModule.require traversal.
- Correlate sandbox evaluation events with subsequent process, file, and network activity on the same host.
Monitoring Recommendations
- Enable process-lineage telemetry on hosts running vm2-backed services and treat any child of the Node.js runtime as suspicious by default.
- Log all inputs to the sandbox evaluation endpoint with sufficient retention to support post-incident review.
- Capture Node.js stderr for uncaught exception patterns referencing cause chains that reach host globals.
How to Mitigate CVE-2026-47686
Immediate Actions Required
- Upgrade vm2 to version 3.11.6 across all applications and container images.
- Audit embedder-exposed host functions and remove any that throw errors carrying host objects as cause.
- Restrict network exposure of any endpoint that accepts user-supplied code into vm2 until the upgrade is deployed.
- Plan migration away from vm2, which the maintainer has deprecated, toward isolated-vm, Node.js worker threads with policy, or WebAssembly-based sandboxes.
Patch Information
The fix is available in vm2 3.11.6 and lands in commit 7e3faaf550f4ab975bf4cdde183fcec49b056d8e. The patched handleException() extends sanitization to cover Error.cause in addition to the previously handled SuppressedError and AggregateError properties. Release artifacts are published under the vm2 3.11.6 release tag.
Workarounds
- If immediate upgrade is not possible, wrap embedder-exposed host functions so they catch internal errors and re-throw sanitized error objects with no cause property set.
- Disable or gate the sandbox evaluation feature for untrusted users until the patched version is deployed.
- Run the Node.js host process under a dedicated low-privilege user with seccomp, AppArmor, or SELinux policies that deny execve and outbound network access.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
