Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process from an embedder-exposed host function that throws an error with that object as its cause and then execute arbitrary host commands. This issue is fixed in version 3.11.6.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-18 | 3 | Disclosure1Exploit1General1 |
| 2026-08-20 | 1 | Disclosure1 |
| 2026-08-21 | 1 | PoC1 |
🛡️ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-19478 - EXPLOIT CVE-2026-71518 - EXPLOIT CVE-2026-74253 CVE-2026-74843 CVE-2026-47686 ..🧵👇
Post summary
The digest lists several CVEs, noting two with an "EXPLOIT" tag, but provides no technical details, proof of concept, or patch information.
A vm2 sandbox escape (CVE-2026-47686, CVSS 9.9) with public PoC lets attackers hijack the host. Two more critical flaws patched in 3.11.6. #vm2 #CVE202647686 #SandboxEscape #RCE #NodeJS #InfoSec https://securityonline.info/vm2-sandbox-escape-cve-2026-47686/
Post summary
New critical VM2 sandbox escape (CVE-2026-47686, CVSS 9.9) disclosed with a public PoC that enables host hijack.
[CVE] CVE-2026-47686 [HIGH PRIORITY] #vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE 🔗 https://exploitgrid.net/cve/CVE-2026-47686
Post summary
CVE-2026-47686 is a high‑priority vulnerability that permits VM2 sandbox escape leading to remote code execution; a link to exploit details is provided but no patch, active exploitation, or PoC code is explicitly described.
CVE-2026-47686 (CVSS 9.9): PoC vm2 Host Hijack - https://securityonline.info/vm2-sandbox-escape-cve-2026-47686/
Post summary
A Proof of Concept for CVE-2026-47686, demonstrating host hijack, has been released via a linked URL, with no indication of active exploitation or patches.
🚨Critical - vm2 sandbox escape → host RCE, plus alloc-limit DoS (CVE-2026-47698, CVE-2026-47686, GHSA-m5w8-4gq2-6f8x, CVE-2026-47683, GHSA-v836-6xw4-9cx3) Five flaws in vm2 < 3.11.6. Escape → host RCE: the proto-mutator fix is bypassable via http://indirectcall.call(indirectcall, dangerousmutator, ...); handleException() doesn't sanitize Error.cause, leaking host objects like process; DANGEROUS_BUILTINS omits os/dns, so builtin: ['*'] allows a process-wide DNS hijack. DoS: bufferAllocLimit bypassable via Buffer.concat and TypedArray constructors. 👉Affected: vm2 (npm) ≤ 3.11.5 | Upgrade to 3.11.6
Post summary
The post exposes five critical vm2 sandbox escape flaws that enable host remote code execution and denial‑of‑service, illustrates operational exploitation steps, and recommends upgrading to 3.11.6.