What is CVE-2026-47698?
A vulnerability in vm2 sandbox allows sandbox code to break the host prototype chain. Prior to version 3.11.6, `lib/bridge.js` and `lib/setup-sandbox.js` fail to block stacked indirection via Function.prototype.call, giving access to dangerous host prototype getter and setter mutators. Users should upgrade to vm2 version 3.11.6 or later.
Azərbaycanca: vm2 sandbox mühitində zəiflik aşkarlanıb. 3.11.6 versiyasından əvvəl `lib/bridge.js` və `lib/setup-sandbox.js` fayllarında Function.prototype.call vasitəsilə təhlükəli host prototip mutatorlarına giriş bloklanmır, bu da sandbox koduna host prototip zəncirini qırmağa imkan verir. vm2-ni 3.11.6 və ya daha yeni versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-94
FAQ2
Which versions of the vm2 sandbox are affected by CVE-2026-47698?
This vulnerability affects all versions of vm2 prior to version 3.11.6.
What technique allows vm2 sandbox code to break the host prototype chain?
The lack of blocking for stacked indirection via Function.prototype.call in `lib/bridge.js` and `lib/setup-sandbox.js` allows this.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.