PT-2026-42147 · Npm+1 · Vm2

Published 2026-05-20 · Updated 2026-06-12 · CVE-2026-47137

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.4

Description A security check in nodevm.js designed to block the combination of nesting: true and require: false is bypassed because it uses strict equality (options.require === false). If the require option is omitted, options.require is undefined, causing the check to fail. Subsequently, a destructuring default assigns requireOpts = false, resulting in the restricted configuration. This allows an attacker running code inside a NodeVM({ nesting: true }) sandbox to achieve full Remote Code Execution (RCE) on the host system by requiring the vm2 library and constructing an inner NodeVM with access to child process.execSync to execute arbitrary OS commands.

Recommendations Update to version 3.11.4 or later.

Fix

Weakness Enumeration

CWE-913

Related Identifiers

CVE-2026-47137

GHSA-M4WX-M65X-GHRR

Affected Products

Vm2

References · 11

• https://osv.dev/vulnerability/GHSA-m4wx-m65x-ghrr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47137 · Security Note
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/commit/86ab819f202c3a8dad88cef5705f2e416c5188d7 · Note
• https://github.com/patriksimek/vm2/releases/tag/v3.11.4 · Note
• https://github.com/patriksimek/vm2/commit/01a7552add345d5a6862623884e6b79a85bf0568 · Note
• https://github.com/patriksimek/vm2/security/advisories/GHSA-m4wx-m65x-ghrr · Note
• https://twitter.com/VulmonFeeds/status/2065486268339798325 · Twitter Post
• https://twitter.com/SecAlertsCo/status/2060747048161312825 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1tih49l/top_10_trending_cves_20052026 · Reddit Post
• https://github.com/advisories/GHSA-g644-9gfx-q4q4 · Note