CVE-2026-47686

{
  "id": "CVE-2026-47686",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-17T21:16:45.507",
  "lastModified": "2026-10-23T16:10:00.313",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process from an embedder-exposed host function that throws an error with that object as its cause and then execute arbitrary host commands. This issue is fixed in version 3.11.6."
    },
    {
      "lang": "es",
      "value": "vm2 es una vm/sandbox de código abierto para Node.js. Anteriormente a la 3.11.6, handleException() en lib/setup-sandbox.js sanitiza SuppressedError.error, SuppressedError.suppressed y AggregateError.errors, pero no sanitiza Error.cause, permitiendo que el código de la sandbox obtenga un objeto host potente como process de una función host expuesta por el incrustador que lanza un error con ese objeto como su causa y luego ejecutar comandos host arbitrarios. Este problema se ha solucionado en la versión 3.11.6."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "patriksimek",
          "product": "vm2",
          "versions": [
            {
              "version": "< 3.11.6",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-18T00:00:00+00:00",
          "id": "CVE-2026-47686",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-693"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/patriksimek/vm2/commit/7e3faaf550f4ab975bf4cdde183fcec49b056d8e",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/patriksimek/vm2/releases/tag/3.11.6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m283-3h24-438v",
      "source": "[email protected]"
    }
  ]
}