CVE-2026-47686 vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE
Attackers can escape the vm2 sandbox and execute arbitrary host commands by exploiting unsanitized Error.cause properties in exception handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47686?
CVE-2026-47686 is a critical code injection vulnerability in patriksimek vm2, published on 17 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process from an embedder-exposed host function that throws an error with that object as its cause and then execute arbitrary host commands. This issue is fixed in version 3.11.6.
Weakness: CWE-693
Which versions are affected by CVE-2026-47686?
2 open source packages ship an affected version, including vm2.
| Package | Affected | Fixed in |
|---|---|---|
vm2 npm | All versions | 3.11.6 |
vm2 npm | All versions | 3.11.6 |
How do I fix CVE-2026-47686?
Upgrade vm2 to 3.11.6 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-47686 being exploited?
There is no known exploitation of CVE-2026-47686 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-PD83197, ECHO-728a-4ca3-07f3, GHSA-m283-3h24-438v, MINI-qhpq-vwxw-56cv, ROOT-APP-NPM-CVE-2026-47686.