Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vm2 | npm | <= 3.11.5 | 3.11.6 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-47698, is a sandbox breakout in vm2 caused by the failure to block stacked indirection attacks that lead to host prototype mutation. The analysis of the patch commit a85acb61f81402c6eabf32760aa11272af6d0f9e reveals the core of the vulnerability and the affected functions.
The vulnerability stems from the ability of sandboxed code to obtain references to dangerous host-side functions (prototype mutators) and then execute them. The patch addresses this in two main locations: lib/bridge.js and lib/setup-sandbox.js.
In lib/bridge.js, within the createBridge function, several internal functions responsible for marshalling objects between the host and the sandbox were vulnerable:
createBridge.thisEnsureThis: This function could return a raw host object, which, if its prototype chain was severed, could be used to escalate privileges. The patch adds checks to prevent returning these raw objects.createBridge.thisFromOtherForThrow: This function could pass dangerous host functions to the sandbox as part of thrown exceptions. The patch adds a check to filter out these dangerous functions.In lib/setup-sandbox.js:
handleException: This function is the central point for handling exceptions within the sandbox. Before the patch, it did not correctly handle exceptions involving host objects with manipulated prototype chains. An attacker could craft an exception that, when handled by this function, would lead to a sandbox escape. The patch introduces a new function, isForeignSeveredHostValue, which is used by handleException to identify and neutralize these malicious objects.The root cause is the lack of proper validation and sanitization of objects, particularly functions and exception objects, that cross the boundary between the sandbox and the host. The attackers found ways to bypass existing checks by using multiple layers of indirection, which the original checks did not account for. The patch implements a defense-in-depth strategy by adding checks at multiple points in the object marshalling and exception handling logic.
createBridge.thisEnsureThislib/bridge.js
createBridge.thisFromOtherForThrowlib/bridge.js
handleExceptionlib/setup-sandbox.js