Loading vulnerability…
vm2 NodeVM patch bypass sandbox escape
CVE-2026-47137 is a critical sandbox escape vulnerability in the vm2 library for Node.js affecting versions up to and including 3.11.3. The flaw is a bypass of the earlier fix for CVE-2023-37903 in NodeVM option validation. The vulnerable logic attempted to block the unsafe combination of nesting enabled with module loading disabled by checking whether options.nesting was enabled and options.require was strictly equal to false. That guard is bypassed when the require option is omitted entirely, because the value is undefined during validation and therefore does not satisfy the strict equality check. Later in the same code path, destructuring assigns the default value false to the omitted require option, recreating the exact insecure state the guard was intended to prevent. In practice, an attacker who can execute JavaScript inside a vm2 NodeVM configured with nesting enabled can exploit this inconsistency to load vm2 from within the sandbox, create an inner NodeVM with permissive module access, and escape the sandbox boundary to reach host execution primitives.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in complete sandbox escape and host-side arbitrary command execution. An attacker can execute operating system commands from code that was supposed to remain confined within the vm2 sandbox. Because the vulnerability crosses the sandbox boundary, impact includes full compromise of confidentiality, integrity, and availability of the host process and potentially the underlying system, including access to application secrets, files, credentials, tokens, and other resources reachable by the Node.js process.
If you can’t patch tonight, do this now.
If immediate patching is not possible, avoid using NodeVM with nesting enabled for any untrusted code execution. Ensure nested configurations do not omit the require option and do not allow falsy or invalid require settings in nested NodeVM scenarios. More broadly, avoid relying on vm2 as a strong security boundary for hostile code and consider stronger isolation models such as separate processes, containers, or microVM-based isolation for security-critical workloads.
Patch, then assume compromise.
Upgrade vm2 to version 3.11.4 or later. The fix moves option handling so validation is performed against the computed require configuration rather than the raw possibly undefined input, broadens the nesting checks, and enforces that require in nested configurations must be a valid non-null object or Resolver instance rather than a falsy value. All deployments using vm2 3.11.3 or earlier should be treated as vulnerable and updated immediately.
No public exploits tracked yet. Mallory keeps watching.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.