CVE-2026-47698: 
JavaScript vulnerability analysis and mitigation

CVE-2026-47698 is a critical sandbox breakout vulnerability in vm2, an open-source Node.js VM/sandbox library, classified as "Sandbox Breakout Using Dangerous Host Proto Mutators." It affects all versions up to and including 3.11.5, with the fix released in version 3.11.6. The vulnerability was published on August 14, 2026, and added to the GitHub Advisory Database on August 17, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory, Feedly).

The root cause is CWE-913 (Improper Control of Dynamically-Managed Code Resources) in lib/bridge.js and lib/setup-sandbox.js. The vulnerability is a bypass of a prior fix (GHSA-v6mx-mf47-r5wg): the previous defense peeled exactly one layer of Function.prototype.{call,apply,bind} indirection, but an attacker can stack two layers — e.g., Buffer.call.call(Buffer.call, setProto, target, null) — pushing the dangerous host prototype mutator out of the inspected argument position. This allows sandbox code to sever a host intrinsic's prototype chain and then reach e.constructor.constructor to execute arbitrary host commands. A secondary bypass variant laundered the __proto__ setter entirely host-side using Function.prototype.apply.bind(call, call) composed over a genuine host array's .map, bypassing all identity-based bridge checks entirely. A public PoC is included in the official advisory (Github Advisory, Patch Commit).

Successful exploitation allows an attacker with the ability to execute code inside a vm2 sandbox to fully escape the sandbox and execute arbitrary commands on the host system, achieving Remote Code Execution (RCE). This results in complete compromise of confidentiality, integrity, and availability of the host environment. Any application that uses vm2 to safely execute untrusted user-supplied JavaScript is directly at risk, potentially enabling data exfiltration, system takeover, or lateral movement within the host infrastructure (Github Advisory).

A working proof-of-concept (PoC) is publicly available and included in the official security advisory, demonstrating sandbox escape and arbitrary command execution via child_process.execSync. The NVD SSVC assessment classifies this as automatable with total technical impact. The EPSS score is approximately 0.56% (44th percentile), indicating moderate near-term exploitation probability. No specific threat actor attribution or confirmed in-the-wild exploitation campaigns have been reported at this time, and the vulnerability does not appear in the CISA KEV catalog as of the time of this report (Github Advisory, Feedly).

1. Identify target: Locate applications that use vm2 versions <= 3.11.5 to execute untrusted or user-supplied JavaScript code (e.g., online code execution platforms, plugin systems, or serverless function runners).
2. Craft stacked-indirection payload: Prepare a JavaScript payload that uses double-layered Function.prototype.call indirection to access dangerous host prototype getter/setter mutators without triggering the bridge's single-layer inspection defense.
3. Retrieve host prototype getter/setter: Inside the sandbox, execute:

   const getProto = Buffer.call.call(Buffer.call, {}.__lookupGetter__, Buffer, "__proto__");
   const setProto = Buffer.call.call(Buffer.call, {}.__lookupSetter__, Buffer, "__proto__");

4. Sever host intrinsic prototype chain: Use an async function with WebAssembly.compileStreaming() to generate a caught error object e, then call setProto on e's prototype to set it to null, severing the prototype chain.
5. Reach host Function constructor: In a second catch block, access e.constructor.constructor — which now resolves to the host's Function constructor rather than the sandboxed one.
6. Execute arbitrary host commands: Use the host Function constructor to access process and invoke child_process.execSync or equivalent to run arbitrary OS commands:

   e.constructor.constructor("return process")().mainModule.require('child_process').execSync('touch pwned');

   (Github Advisory, Patch Commit)

• Process: Unexpected child processes spawned by the Node.js process running vm2 (e.g., sh, bash, cmd.exe, execSync-invoked binaries); unusual use of child_process module from within sandboxed code execution contexts.
• File System: Unexpected files created or modified by the Node.js process (e.g., files like pwned as demonstrated in the PoC); new scripts or executables dropped in application directories.
• Logs: Application logs showing errors related to WebAssembly.compileStreaming() being called without valid arguments in rapid succession; unexpected require('child_process') calls originating from vm2 sandbox execution paths.
• Network: Outbound connections from the Node.js server process to unexpected external hosts, potentially indicating reverse shell or data exfiltration activity following sandbox escape.

Upgrade vm2 to version 3.11.6 or later, which introduces two independent, mechanism-independent chokepoints in lib/bridge.js and lib/setup-sandbox.js that refuse to deliver raw host prototype mutators across the bridge and reject host-realm objects with severed prototype chains. No configuration-based workaround is available for versions <= 3.11.5; the only effective remediation is upgrading. Organizations unable to upgrade immediately should consider disabling or restricting access to any functionality that allows untrusted code execution via vm2 until the patch can be applied (Github Advisory, vm2 Release).

The advisory credits nine independent security researchers (XmiliaH, the-vibe-dev, oran-s, dinhvaren, PowerliftLog, zolbooo, nil340, rexpository, lukefr09) for reporting the vulnerability, indicating broad community engagement in vm2 sandbox security research. Security news outlet SecurityOnline.info covered the disclosure, and the vulnerability was picked up by multiple vulnerability tracking platforms including VulnDB, OSV, and CVEFeed shortly after publication. The vm2 project has a well-documented history of sandbox escape vulnerabilities, and this disclosure continues a pattern of incremental bypass discoveries against prior fixes (Github Advisory, vm2 Release).