VulnSocial

CVE-2026-47208Patch

MEDIUMCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.4.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-913

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 5 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-06-13); latest day: 1
  • 5 total mentions across 4 days

Deep dive

Activity timeline5 mentions / 4d
01122Mentions · 2026-05-30: 1Mentions · 2026-06-12: 1Mentions · 2026-06-13: 2Mentions · 2026-06-19: 1PoC Mentioned / Linked · 2026-06-13: 1Exploit Tool / Code · 2026-06-13: 1Patch / Workaround · 2026-05-30: 1Patch / Workaround · 2026-06-13: 2Technical Details · 2026-05-30: 1Technical Details · 2026-06-12: 1Technical Details · 2026-06-13: 205-3006-1206-1306-19
Signal classification2 categories
Patch
360.0%
Disclosure
240.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-05-301
Patch1
2026-06-121
Disclosure1
2026-06-132
Patch2
2026-06-191
Disclosure1
Full discourse5 posts
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    🧨 vm2 Sandbox: A Cluster of Perfect-10 Breakouts The Node.js vm2 sandbox library is having a catastrophic week. Four separate CVSS 10.0 vulnerabilities — CVE-2026-47208, CVE-2026-47137, CVE-2026-47140, and CVE-2026-47131 — all…

    Post summary

    The article publicly discloses four high‑severity CVEs impacting the Node.js vm2 sandbox library, framing it as a catastrophic vulnerability cluster.

    1000027
    81 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-47208 - CRITICAL sandbox breakout in Vm2 Node.js. CVSS 10.0. Allows arbitrary code execution on host. Update to v3.11.4 immediately. #CVE #NodeJS #infosec #CVEAlert #CyberSecurity FREE IT Expert portal with Yara and Sigma rules, POC: https://www.valtersit.com/cve/CVE-2026-47208/

    Post summary

    CVE-2026-47208 is a critical sandbox breakout that allows arbitrary code execution; immediate patch to v3.11.4 is required and a PoC is available.

    0000054
    929 followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 CRITICAL: CVE-2026-47208 | CVSS 10.0 vm2 Node.js sandbox breakout allows arbitrary command execution on host systems. All versions <3.11.4 affected. Patch immediately to v3.11.4+ #CVE #PatchNow https://t.co/vJ3q3kEODj

    Post summary

    The tweet highlights the critical CVE-2026-47208 affecting vm2 Node.js sandbox, details an RCE via sandbox breakout, and urges immediate patching to version 3.11.4+.

    0000019
    44 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-47208 Sandbox Breakout Vulnerability in VM2 Prior to Version 3.11.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47208

    Post summary

    The statement identifies a sandbox breakout flaw in VM2 before version 3.11.4 but provides no evidence of exploitation, PoC, or patches.

    0000032
    4.0K followersView on X
  • SecAlerts@SecAlertsCo
    Patch

    CVSS 10 🔓 CVE-2026-47208 hits vm2 (npm): sandbox breakout lets attackers escape the VM and run arbitrary commands on the host. If you use vm2, update to v3.11.4 now. #nodejs #security https://secalerts.co/vulnerability/CVE-2026-47208 https://t.co/aP1UeXX2fW

    Post summary

    The tweet highlights a critical CVE in vm2 that enables sandbox escape and urges users to upgrade to v3.11.4, with no mention of PoC, exploit code, or active exploitation.

    0000072
    826 followersView on X

Explore more

Back to dashboard