CVE-2026-47686

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.6

Description In the handleException() function within lib/setup-sandbox.js, the software fails to sanitize the Error.cause property introduced in ES2022. While the function recursively sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors, it ignores Error.cause. This allows sandbox code to obtain a reference to a powerful host object, such as process, if an embedder-exposed host function throws an error with that object assigned to the cause variable. An attacker can leverage this reference to escape the sandbox and execute arbitrary commands on the host system.

Recommendations Update vm2 to version 3.11.6.