Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in bridge.js (line 1231) ignores the receiver parameter and unconditionally writes to the host target object. Per the Proxy set trap specification, when receiver !== proxy (e.g., when a child object inherits from the proxy via Object.create), the property assignment should create an own property on the receiver, not on the proxy target. The current implementation always calls otherReflectSet(object, key, value) against the host target, causing all inherited property writes to leak through to the host object. This bug provides an alternative attack vector for writing dangerous cross-realm Symbol keys (e.g., nodejs.util.promisify.custom) to host objects, bypassing any future per-trap isDangerousCrossRealmSymbol guard on the direct set path. This issue has been patched in version 3.11.4.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-19 | 1 | General1 |
| 2026-06-12 | 1 | Disclosure1 |
| 2026-06-13 | 1 | Patch1 |
vm2 cve*3 1 Critical10/ 10 2 high CVE-2026-47137 CVE-2026-47209 CVE-2026-47135 https://t.co/mVLkWf7QCs
Post summary
The tweet lists three recently disclosed CVE identifiers and provides a single URL, but offers no additional technical, exploitation, or remediation details.
🚨 HIGH: CVE-2026-47209 in vm2 Node.js sandbox (CVSS 8.6). Proxy handler flaw allows cross-realm property writes to host objects, bypassing security isolation. Patch to v3.11.4+ immediately. #CVE #PatchNow #NodeJS https://t.co/WqgIpNoi82
Post summary
The tweet alerts about a high‑severity CVE-2026-47209 in the vm2 Node.js sandbox, detailing a proxy handler flaw that permits cross‑realm property writes and urges immediate patching to v3.11.4+.
CVE-2026-47209 Privilege Escalation via Proxy Set Trap in vm2 Before Version 3.11.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47209
Post summary
The content announces CVE‑2026‑47209 as a privilege escalation flaw in vm2 versions prior to 3.11.4, providing technical details without mentioning PoC, patches, or active exploitation.