8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47135

CVE-2026-47135: vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combined with the bridge's set/defineProperty/deleteProperty traps having no isDangerousCrossRealmSymbol key check, sandbox code can obtain real cross-realm symbols, write them to host objects, and control host-side behavior — verified with a full util.promisify hijack chain. This issue has been patched in version 3.11.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47135

CVE-2026-47135:

8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vm2	npm	<= 3.11.3	3.11.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in vm2 (GHSA-m5q2-4fm3-vfqp) is a sandbox escape caused by a combination of two main weaknesses. First, the sandbox's override of the global Symbol.for function was incomplete. It only blocked two of nine known dangerous Node.js internal symbols. This allowed sandboxed code to create and get references to real cross-realm symbols (e.g., nodejs.util.promisify.custom) that Node.js internals use for special hooks. Second, the proxy-based bridge that separates the sandbox from the host environment had a critical flaw in its write-trap handlers (set, defineProperty, deleteProperty). These traps, which handle property modifications on host objects, failed to check if the property key being used was one of these dangerous symbols.

An attacker could exploit this by first using the flawed Symbol.for to obtain a real dangerous symbol. Then, they could use this symbol as a property key in an assignment (=), Object.defineProperty, or delete operation on a host object exposed to the sandbox. This would allow the attacker to install a custom function (a hook) or modify the behavior of the host object. For example, by setting a custom nodejs.util.promisify.custom function on a host function, the attacker could control the result of util.promisify on the host side, leading to data integrity issues and allowing the sandbox to influence host-side control flow. The patch addresses this with a two-layer fix: it blocks the entire nodejs.* namespace in Symbol.for and adds the missing security checks to the bridge's write traps.

Vulnerable functions

Symbol.for

lib/setup-sandbox.js

The override for `Symbol.for` in the sandbox was incomplete. It only blocked two out of nine dangerous Node.js internal symbols (`nodejs.util.inspect.custom` and `nodejs.rejection`), allowing sandbox code to create and obtain references to other real cross-realm symbols like `nodejs.util.promisify.custom`. This allowed the sandbox to craft values that could be used to manipulate host-side behavior.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.