CVE-2026-47698

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.6

Description A sandbox breakout allows code running within the environment to escape and execute arbitrary commands on the host system. The issue occurs because lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators. This enables the sandbox code to sever a host intrinsic's prototype chain and reach e.constructor.constructor for arbitrary host command execution.

Recommendations Update to version 3.11.6.