VulnSocial

CVE-2026-47131Disclosure

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__"), Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__"), and Node.js's ERR_INVALID_ARG_TYPE Error, the host's TypeError constructor can be obtained, which allows the escape from the sandbox. This allows attackers to run arbitrary code. This issue has been patched in version 3.11.4.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-913

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • Peaked 3d ago at 1 mentions (2026-05-30); latest day: 1
  • 4 total mentions across 4 days

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-05-30: 1Mentions · 2026-05-31: 1Mentions · 2026-06-12: 1Mentions · 2026-06-19: 1Patch / Workaround · 2026-05-30: 1Technical Details · 2026-05-30: 1Technical Details · 2026-05-31: 1Technical Details · 2026-06-12: 1Technical Details · 2026-06-19: 105-3005-3106-1206-19
Signal classification2 categories
Disclosure
375.0%
Patch
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-05-301
Patch1
2026-05-311
Disclosure1
2026-06-121
Disclosure1
2026-06-191
Disclosure1
Full discourse4 posts
  • SecAlerts@SecAlertsCo
    Patch

    CVSS 10.0 in vm2 (npm). CVE-2026-47131 is a critical sandbox escape via prototype manipulation - no auth, no interaction, full host compromise possible. If you use vm2, update to v3.11.4 now. #nodejs #security https://secalerts.co/vulnerability/CVE-2026-47131 https://t.co/joOqWabxcz

    Post summary

    The tweet announces CVE-2026‑47131 as a critical sandbox escape in the vm2 npm package, urging users to upgrade to v3.11.4 immediately to mitigate the zero‑auth, no‑interaction vulnerability.

    0110094
    826 followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    🧨 vm2 Sandbox: A Cluster of Perfect-10 Breakouts The Node.js vm2 sandbox library is having a catastrophic week. Four separate CVSS 10.0 vulnerabilities — CVE-2026-47208, CVE-2026-47137, CVE-2026-47140, and CVE-2026-47131 — all…

    Post summary

    The Node.js vm2 sandbox library is disclosed to have four CVSS 10.0 vulnerabilities (CVE-2026-47208, CVE-2026-47137, CVE-2026-47140, and CVE-2026-47131), with no mention of PoC, exploit code, active exploitation, or available mitigations.

    1000027
    81 followersView on X
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨Critical - vm2 Sandbox Escape (CVE-2026-47131) vm2 (a popular sandbox library for Node.js) contains a critical sandbox escape vulnerability. By leveraging specific Buffer prototype manipulations and WebAssembly.compileStreaming error handling, an attacker can obtain the host's TypeError constructor and ultimately escape the sandbox to execute arbitrary code on the host system. This leads to full remote code execution (RCE) in environments that use vm2 to run untrusted code. 👉Affected: vm2 <= 3.11.3

    Post summary

    The post announces a critical sandbox escape vulnerability in vm2 (CVE‑2026‑47131), detailing how manipulation of Buffer prototype and WebAssembly.compileStreaming can lead to remote code execution on the host. No PoC, exploit code, active exploitation, patch, or debunking information is provided.

    00010113
    196 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-47131 Sandbox Escape and Arbitrary Code Execution in vm2 Before 3.11.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47131 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4

    Post summary

    The post announces CVE‑2026‑47131, noting a sandbox escape and arbitrary code execution vulnerability in vm2 versions prior to 3.11.4, but provides no PoC, exploit, or patch information.

    0000030
    4.0K followersView on X

Explore more

Back to dashboard