CVE-2026-47698

9.8 Critique

Publiée le 17/08/2026 à 23:16 · Modifiée le 23/10/2026 à 18:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and reach e.constructor.constructor for arbitrary host command execution. This issue is fixed in version 3.11.6.

Traduire en français

Produits concernés

patriksimek vm2

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-913

Références

https://github.com/patriksimek/vm2/commit/a85acb61f81402c6eabf32760aa11272af6d0f9e
https://github.com/patriksimek/vm2/releases/tag/3.11.6
https://github.com/patriksimek/vm2/security/advisories/GHSA-cfcw-xp6x-25gj
https://github.com/patriksimek/vm2/security/advisories/GHSA-cfcw-xp6x-25gj

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories