Log in Start free

Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M

CVE-2026-47137vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE

Critical 10.0

In plain English

A critical-severity security flaw in vm2 from patriksimek. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.4%top 67.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) introduced a check in nodevm.js line 263 that blocks the combination nesting: true + require: false. However, the check uses strict equality (options.require === false), which is trivially bypassed by omitting the require option entirely. When require is not specified, options.require is undefined, not false. The strict equality check fails, so the security guard is skipped. Immediately after (line 280), the destructuring default require: requireOpts = false assigns requireOpts = false, producing the exact configuration the patch was designed to prevent. This issue has been patched in version 3.11.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmvm23.11.4GHSA-m4wx-m65x-ghrr

Affected products (as reported)

VendorProductVersions
patriksimek vm2 < 3.11.4

Weakness: CWE-913 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References