CVE-2026-47210

{
  "id": "CVE-2026-47210",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T15:16:29.030",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code execution in the host process when untrusted code is executed with async support on runtimes exposing WebAssembly JSPI (WebAssembly.promising / WebAssembly.Suspending). In the tested configuration, a JSPI-backed Promise can reach Promise.prototype.finally() in a way that bypasses the expected Promise-species hardening and exposes a host-originated rejection object to attacker-controlled species logic, breaking the sandbox boundary. This issue has been patched in version 3.11.4."
    },
    {
      "lang": "es",
      "value": "vm2 es una vm/sandbox de código abierto para Node.js. Antes de la versión 3.11.4, una vulnerabilidad de escape de sandbox en vm2 permite la ejecución de código arbitrario en el proceso anfitrión cuando se ejecuta código no confiable con soporte asíncrono en entornos de ejecución que exponen WebAssembly JSPI (WebAssembly.promising / WebAssembly.Suspending). En la configuración probada, una Promesa respaldada por JSPI puede alcanzar Promise.prototype.finally() de una manera que elude el endurecimiento esperado de las especies de Promesa y expone un objeto de rechazo originado en el anfitrión a la lógica de especies controlada por el atacante, rompiendo el límite de la sandbox. Este problema ha sido parcheado en la versión 3.11.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "patriksimek",
          "product": "vm2",
          "versions": [
            {
              "version": "< 3.11.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-12T00:00:00+00:00",
          "id": "CVE-2026-47210",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-913"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/patriksimek/vm2/commit/6915fa4d9bcebd47b9a4f39a1adc1aa94ef6ffc6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-6j2x-vhqr-qr7q",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-6j2x-vhqr-qr7q",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}