CVE-2026-47210 Details
Description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code execution in the host process when untrusted code is executed with async support on runtimes exposing WebAssembly JSPI (WebAssembly.promising / WebAssembly.Suspending). In the tested configuration, a JSPI-backed Promise can reach Promise.prototype.finally() in a way that bypasses the expected Promise-species hardening and exposes a host-originated rejection object to attacker-controlled species logic, breaking the sandbox boundary. This issue has been patched in version 3.11.4.
A sandbox escape vulnerability has been identified in vm2, a popular Node.js library that provides a virtual machine/sandbox environment. This vulnerability, present in versions through 3.11.3, allows for arbitrary code execution in the host process. The issue arises when untrusted code is executed with asynchronous support in environments that expose WebAssembly JavaScript Promise Integration (JSPI) features, such as Node.js 26. In this scenario, a JSPI-backed Promise can bypass the expected safeguards and manipulate host-originated rejection objects, effectively breaking the sandbox isolation.
Users can upgrade to vm2 version 3.11.4, which removes the WebAssembly JSPI surface from the sandbox, effectively closing this vulnerability. Instructions for upgrading can be found in the vm2 release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/patriksimek/vm2/security/advisories/GHSA-6j2x-vhqr-qr7q | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/patriksimek/vm2/commit/6915fa4d9bcebd47b9a4f39a1adc1aa94ef6ffc6 | [email protected] | Source CodeVendor |
| https://github.com/patriksimek/vm2/releases/tag/v3.11.4 | [email protected] | Release NotesVendor |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-6j2x-vhqr-qr7q | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-913 | Improper Control of Dynamically-Managed Code Resources | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vm2 | <= 3.11.3 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |