CVE-2026-47698: 
JavaScript Analyse et atténuation des vulnérabilités

CVE-2026-47698 is a critical sandbox breakout vulnerability in the vm2 Node.js sandbox library, classified as "Sandbox Breakout Using Dangerous Host Proto Mutators." It affects all versions of vm2 up to and including 3.11.5, and was published on August 14, 2026, with the GitHub Advisory Database entry updated on August 17, 2026. The vulnerability allows sandbox code to escape the vm2 isolation boundary and execute arbitrary commands on the host system. It carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory, Feedly).

The root cause is classified as CWE-913 (Improper Control of Dynamically-Managed Code Resources). The vulnerability is a bypass of a prior fix (GHSA-v6mx-mf47-r5wg): the previous patch inspected only one layer of Function.prototype.{call,apply,bind} / Reflect.{apply,construct} indirection to block dangerous host prototype mutators, but an attacker can stack two layers — e.g., Buffer.call.call(Buffer.call, setProto, target, null) — pushing the dangerous mutator out of the inspected argument position. This allows sandbox code to sever a host intrinsic's prototype chain and then reach e.constructor.constructor to obtain a reference to the host Function constructor, enabling arbitrary command execution. A secondary bypass variant laundered the __proto__ setter entirely host-side using Function.prototype.apply.bind(call, call) composed over a genuine host array's .map, so the dangerous setter ran in the host realm without re-crossing the bridge, defeating identity-based checks. A public proof-of-concept is included in the official advisory (Github Advisory, Patch Commit).

Successful exploitation grants an attacker full remote code execution on the host system running the vm2 sandbox, with the same privileges as the Node.js process. This results in complete compromise of confidentiality, integrity, and availability — an attacker can read sensitive data, modify or delete files, execute system commands, and potentially pivot to other systems accessible from the host. Any application that accepts and executes untrusted JavaScript code within a vm2 sandbox is at risk, including code execution platforms, online IDEs, and plugin systems (Github Advisory, Feedly).

A working proof-of-concept exploit is publicly available in the official GitHub Security Advisory, demonstrating sandbox escape and arbitrary command execution via child_process.execSync (Github Advisory). The vulnerability requires no privileges and no user interaction — any attacker able to supply code to a vm2 sandbox can exploit it. The EPSS score is currently 0.0, reflecting early-stage data, and there is no confirmed evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (Feedly).

1. Identify target: Locate an application that accepts and executes untrusted JavaScript code inside a vm2 sandbox (e.g., an online code execution service, plugin runner, or REPL).
2. Obtain __proto__ getter/setter via stacked indirection: Use Buffer.call.call(Buffer.call, {}.__lookupGetter__, Buffer, "__proto__") and the corresponding setter variant to retrieve the host prototype getter and setter without triggering the single-layer indirection check.
3. Sever a host intrinsic's prototype chain: Trigger a WebAssembly.compileStreaming() call to generate a caught error object e, then use the retrieved setter to set e's __proto__ to null, severing its prototype chain from the host realm.
4. Escape via e.constructor.constructor: In a second WebAssembly.compileStreaming() catch block, access e.constructor.constructor on the now-severed error object to obtain a reference to the host Function constructor.
5. Execute arbitrary host commands: Invoke e.constructor.constructor("return process")().mainModule.require('child_process').execSync('<command>') to run arbitrary OS commands on the host system (Github Advisory).

• Process: Unexpected child processes spawned by the Node.js process running vm2 (e.g., sh, bash, cmd.exe, curl, wget, or other system utilities) as a result of child_process.execSync or similar calls.
• File System: Unexpected files created or modified on the host (e.g., a file named pwned as demonstrated in the PoC); new scripts, cron jobs, or scheduled tasks created by the Node.js service account.
• Logs: Application logs showing unusual or malformed JavaScript input submitted to the sandbox; Node.js error logs referencing WebAssembly.compileStreaming, __lookupGetter__, __lookupSetter__, or __proto__ manipulation in sandbox-executed code.
• Network: Outbound connections from the Node.js process to unexpected external hosts, potentially indicating reverse shell or data exfiltration activity following sandbox escape (Github Advisory).

Upgrade vm2 to version 3.11.6, which introduces two independent, mechanism-independent chokepoints: lib/bridge.js now refuses to deliver any raw host prototype mutator across the bridge regardless of indirection depth, and lib/setup-sandbox.js rejects any host-realm object whose prototype chain reaches null without passing through the sandbox Object.prototype. No API changes are required for valid configurations. There are no documented configuration-based workarounds; upgrading is the only recommended remediation (Github Advisory, vm2 Release).

The advisory credits eight reporters (XmiliaH, the-vibe-dev, oran-s, dinhvaren, zolbooo, nil340, rexpository, lukefr09), suggesting coordinated responsible disclosure by multiple researchers. The fix was co-authored with Claude Opus 5, reflecting an emerging trend of AI-assisted security patching in open source projects. No major media coverage or notable public social media commentary beyond the advisory itself has been identified at this time (Github Advisory, Patch Commit).