vm2: sandbox escape flaws (CVE-2026-47131, CVE-2026-47208) fixed in 3.11.4 and later
CVE-2026-47131 CVE-2026-47135 CVE-2026-47137 CVE-2026-47139 CVE-2026-47140 CVE-2026-47141 CVE-2026-47208 CVE-2026-47209 CVE-2026-47210 CVE-2026-47683 CVE-2026-47686 CVE-2026-47698 CVE-2026-92933 CVE-2026-92934 CVE-2026-92935 CVE-2026-92936 CVE-2026-92937 CVE-2026-92938 CVE-2026-92939 CVE-2026-92940 CVE-2026-92941 CVE-2026-92942 CVE-2026-92944 CVE-2026-92945 CVE-2026-92946 CVE-2026-92947 CVE-2026-92948 CVE-2026-92949 CVE-2026-92950 CVE-2026-92951
Published 02/11/2026 02:05
Timeline
2 events over 3 d 16 h
- 29/10/2026 10:04ConfirmedBSI CERT-Bund (WID)+3 d 16 h
- 02/11/2026 02:05Published on WatchtowerPro CISO
In short
vm2, an npm sandbox for running untrusted JavaScript in Node.js, has many flaws that let an attacker escape the sandbox and run code on the server. BSI CERT-Bund rates them critical. Upgrade vm2 to 3.11.8 or newer and do not pass untrusted code to it until then.
How bad is it
Critical. An application that runs untrusted JavaScript through vm2 can let an attacker break out of the sandbox and run their own commands on the server.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 30 CVEs · CVSS 3.1 from NVD, from github.com, read 02/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- vm2 3.11.3 and earlier are affected by the sandbox escapes CVE-2026-47131 and CVE-2026-47208.
- vm2 3.11.7 and earlier are affected by the information leak CVE-2026-92933, which only applies on Node.js 22.9 and later (Mend report, not vendor or NVD).
Fixed in
- 3.11 branch: 3.11.8
What to do now
- Find vm2 in every project, including transitive dependencies, for example with npm ls vm2.
- Upgrade vm2 to 3.11.8 or the newest 3.x release; 3.11.4 fixes CVE-2026-47131 and CVE-2026-47208, and 3.11.8 fixes CVE-2026-92933.
- If you cannot upgrade yet, stop passing untrusted or user-supplied code to vm2. This reduces exposure and does not make a server safe.
- Run any code you cannot trust in a separate process, container or VM with no network access and minimal privileges.
- Run the host service as a low-privilege user and limit its outbound access.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 6 open questions, followed up as sources answer and all 5 sources with their dates. And technology matching: which of your systems run vm2, at which version, fixed or not - and what each one needs.
Main sources
[UPDATE] [kritisch] vm2: Mehrere Schwachstellen CERT · [UPDATE] [kritisch] vm2: Mehrere Schwachstellen CERT · [UPDATE] [kritisch] vm2: Mehrere Schwachstellen CERT