Loading vulnerability…
CVE-2026-47137 is a critical sandbox escape vulnerability in the vm2 library for Node.js affecting versions up to and including 3.11.3. The flaw is a bypass of the earlier fix for CVE-2023-37903 in NodeVM option validation. The vulnerable logic attempted to block the unsafe combination of nesting enabled with module loading disabled by checking whether options.nesting was enabled and options.require was strictly equal to false. That guard is bypassed when the require option is omitted entirely, because the value is undefined during validation and therefore does not satisfy the strict equality check. Later in the same code path, destructuring assigns the default value false to the omitted require option, recreating the exact insecure state the guard was intended to prevent. In practice, an attacker who can execute JavaScript inside a vm2 NodeVM configured with nesting enabled can exploit this inconsistency to load vm2 from within the sandbox, create an inner NodeVM with permissive module access, and escape the sandbox boundary to reach host execution primitives.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vm2 vulnerability described as a bypass of the CVE-2023-37903 patch, cited as part of the product's recurring security issues.
A critical vm2 Node.js sandbox escape vulnerability caused by an incomplete guard on NodeVM configuration, allowing sandboxed code to escape and execute arbitrary commands on the host OS.
A critical vm2 patch bypass vulnerability caused by flawed validation logic, allowing attackers to recreate a dangerous nested environment and execute arbitrary OS commands.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.