CVE-2026-47131

Опубликовано: 12 июн. 2026

Источник: nvd

CVSS3: 10

EPSS Низкий

Описание

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.lookupGetter, Buffer, "proto"), Buffer.call.call({}.lookupSetter, Buffer, "proto"), and Node.js's ERR_INVALID_ARG_TYPE Error, the host's TypeError constructor can be obtained, which allows the escape from the sandbox. This allows attackers to run arbitrary code. This issue has been patched in version 3.11.4.

Ссылки

EPSS

Процентиль: 46%

0.00619

Низкий

10 Critical

CVSS3

Дефекты

CWE-913

Связанные уязвимости

CVE-2026-47131

CVSS3: 4.1

redhat

около 2 месяцев назад

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__"), Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__"), and Node.js's ERR_INVALID_ARG_TYPE Error, the host's TypeError constructor can be obtained, which allows the escape from the sandbox. This allows attackers to run arbitrary code. This issue has been patched in version 3.11.4.

GHSA-v6mx-mf47-r5wg