CVE-2026-47131

{
  "id": "CVE-2026-47131",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T15:16:27.870",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer, \"__proto__\"), Buffer.call.call({}.__lookupSetter__, Buffer, \"__proto__\"), and Node.js's ERR_INVALID_ARG_TYPE Error, the host's TypeError constructor can be obtained, which allows the escape from the sandbox. This allows attackers to run arbitrary code. This issue has been patched in version 3.11.4."
    },
    {
      "lang": "es",
      "value": "vm2 es una vm/sandbox de código abierto para Node.js. Antes de la versión 3.11.4, al combinar Buffer.call.call({}.__lookupGetter__, Buffer, ’__proto__’), Buffer.call.call({}.__lookupSetter__, Buffer, ’__proto__’), y el Error ERR_INVALID_ARG_TYPE de Node.js, se puede obtener el constructor TypeError del host, lo que permite el escape de la sandbox. Esto permite a los atacantes ejecutar código arbitrario. Este problema ha sido parcheado en la versión 3.11.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "patriksimek",
          "product": "vm2",
          "versions": [
            {
              "version": "< 3.11.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-12T00:00:00+00:00",
          "id": "CVE-2026-47131",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-913"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/patriksimek/vm2/commit/27c525f4615e2b983f122e2bed327d810126f5c8",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}