Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| patriksimek | vm2 | affected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-m283-3h24-438v | VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE |
Mon, 17 Aug 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process from an embedder-exposed host function that throws an error with that object as its cause and then execute arbitrary host commands. This issue is fixed in version 3.11.6. | |
| Title | vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE | |
| Weaknesses | CWE-693 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-08-17T20:54:39.406Z
Reserved: 2026-05-19T21:18:20.403Z
Link: CVE-2026-47686
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-17T21:16:45.507
Modified: 2026-08-17T21:16:45.507
Link: CVE-2026-47686
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-693
Protection Mechanism Failure