CVE-2026-47698 Overview
CVE-2026-47698 is a sandbox escape vulnerability in vm2, an open source virtual machine and sandbox library for Node.js. Versions prior to 3.11.6 fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators. Sandbox code can sever a host intrinsic's prototype chain and reach e.constructor.constructor to obtain a reference to the host Function constructor. Attackers use that reference to execute arbitrary host commands outside the sandbox boundary. The issue is tracked as [CWE-913: Improper Control of Dynamically-Managed Code Resources] and is fixed in vm2 version 3.11.6.
Critical Impact
Untrusted code executed inside vm2 can escape the sandbox and run arbitrary commands on the host Node.js process.
Affected Products
- vm2 versions prior to 3.11.6
- Node.js applications embedding vm2 for untrusted code execution
- Downstream libraries and services depending on vulnerable vm2 releases
Discovery Timeline
- 2026-08-17 - CVE-2026-47698 published to NVD
- 2026-08-19 - Last updated in NVD database
- Version 3.11.6 - vm2 maintainers release patched build (GitHub Release 3.11.6)
Technical Details for CVE-2026-47698
Vulnerability Analysis
The vm2 sandbox isolates guest code by wrapping host intrinsics with a bridge that filters access to dangerous getters and setters. The bridge logic in lib/bridge.js and lib/setup-sandbox.js inspects direct property mutators to block prototype tampering. Guest code can wrap those mutators with Function.prototype.call to introduce stacked indirection that bypasses the filter checks. Once the checks are bypassed, guest code mutates a host intrinsic's prototype and reaches an unproxied host object.
From an unproxied host object e, the expression e.constructor.constructor resolves to the host realm's Function constructor. Invoking that constructor compiles a new function in the host context, granting the guest code access to the full Node.js API surface, including require, process, and child_process. The result is arbitrary command execution on the host with the privileges of the Node.js runtime.
Root Cause
The bridge did not normalize call-site indirection before comparing the invoked function against its blocklist of host mutators. Wrapping a mutator through Function.prototype.call, and stacking additional .call layers, produced a callable that the filter did not recognize while still invoking the original mutator on the host prototype.
Attack Vector
An attacker supplies JavaScript that runs inside a vm2 sandbox. The payload constructs a stacked Function.prototype.call chain that reaches a host prototype setter, severs the prototype chain of a host intrinsic, then walks constructor.constructor to obtain the host Function builder. The attacker then compiles and invokes host-scoped code to execute shell commands. Exploitation does not require authentication when the calling application accepts untrusted script input.
See the GHSA-cfcw-xp6x-25gj advisory and the remediation commit for technical details.
Detection Methods for CVE-2026-47698
Indicators of Compromise
- Node.js processes spawning unexpected child processes such as sh, bash, cmd.exe, or powershell.exe from services that embed vm2.
- Outbound network connections initiated by a Node.js runtime that normally handles only sandboxed evaluation.
- Guest scripts containing chained references to Function.prototype.call, __proto__, constructor.constructor, or Reflect.setPrototypeOf.
Detection Strategies
- Inventory application dependencies and flag installs where vm2 resolves to a version below 3.11.6.
- Instrument the Node.js runtime with child_process and fs audit hooks to log call sites originating from evaluated sandbox code.
- Perform static analysis on stored user-supplied scripts for prototype-walking patterns targeting host intrinsics.
Monitoring Recommendations
- Alert on any execve, CreateProcess, or equivalent syscall issued by a Node.js process that hosts vm2 workloads.
- Baseline the outbound network profile of sandbox worker processes and alert on deviations.
- Forward Node.js stdout, stderr, and process lineage into a centralized log platform for correlation with untrusted input sources.
How to Mitigate CVE-2026-47698
Immediate Actions Required
- Upgrade vm2 to version 3.11.6 in all applications, containers, and serverless functions.
- Audit dependency trees with npm ls vm2 or yarn why vm2 to locate transitive installs.
- Rotate credentials and secrets that were accessible to any Node.js process running vulnerable vm2 alongside untrusted input.
Patch Information
The fix is available in vm2 3.11.6. The remediation commit hardens lib/bridge.js and lib/setup-sandbox.js to normalize indirection through Function.prototype.call before evaluating mutator access. The vm2 project has been deprecated in favor of isolated-vm; consider migrating workloads that execute untrusted code.
Workarounds
- Move untrusted script execution to an out-of-process sandbox such as isolated-vm or a container with restricted capabilities.
- Run Node.js workers that evaluate untrusted code under a dedicated low-privilege user with no filesystem or network access beyond what the workload requires.
- Apply seccomp, AppArmor, or SELinux profiles that block execve and outbound sockets from the sandbox process.
# Upgrade vm2 to the patched release
npm install vm2@3.11.6 --save
npm ls vm2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
