vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) introduced a check in nodevm.js line 263 that blocks the combination nesting: true + require: false. However, the check uses strict equality (options.require === false), which is trivially bypassed by omitting the require option entirely. When require is not specified, options.require is undefined, not false. The strict equality check fails, so the security guard is skipped. Immediately after (line 280), the destructuring default require: requireOpts = false assigns requireOpts = false, producing the exact configuration the patch was designed to prevent. This issue has been patched in version 3.11.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| patriksimek | vm2 | before 3.11.4 | 3.11.4 | Patch available | CNA |
| — | vm2 (npm) | before 3.11.4 | 3.11.4 | Patch available | GHSA-m4wx-m65x-ghrr |
- vm2 Vendorpatriksimek Affected before 3.11.4 Fixed in 3.11.4 Patch available CNA
- vm2 (npm) Vendor— Affected before 3.11.4 Fixed in 3.11.4 Patch available GHSA-m4wx-m65x-ghrr
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:*:*:* | — | — | patriksimek |
- cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:*:*:* Versions — — ·patriksimek
Remediation
- Fix · CNA vm2 (patriksimek) Fixed in 3.11.4
- Fix · GHSA-m4wx-m65x-ghrr vm2 (npm) Fixed in 3.11.4 Advisory →
Red Hat 3 advisories
- RHSA-2026:50850 Released 2026-08-05 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.1 security update
- Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal
- RHSA-2026:36754 Released 2026-07-08 · Red Hat rating ImportantRed Hat Developer Hub 1.10.2 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:33574 Released 2026-06-30 · Red Hat rating ImportantRed Hat Developer Hub 1.9.6 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2.1 | Fixed | RHSA-2026:50850 |
| Red Hat Developer Hub 1.10 | Fixed | RHSA-2026:36754 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:33574 |
Not affected: 2 products
- Red Hat Developer Hub 1.10
- Red Hat Developer Hub 1.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-47137
- 2026-10-03 Alias added: GHSA-m4wx-m65x-ghrr
- 2026-10-25 EPSS moved to the below the 50th percentile
References
Other 6
- https://github.com/patriksimek/vm2/security/advisories/GHSA-m4wx-m65x-ghrr
- https://github.com/patriksimek/vm2/commit/01a7552add345d5a6862623884e6b79a85bf0568
- https://github.com/patriksimek/vm2/commit/86ab819f202c3a8dad88cef5705f2e416c5188d7
- https://github.com/advisories/GHSA-g644-9gfx-q4q4
- https://github.com/patriksimek/vm2/releases/tag/v3.11.4
- https://github.com/patriksimek/vm2
More patriksimek vulnerabilities
- TI-2023-14382 Sandbox Escape in vm2 CVSS 3.1CRITICAL 10.0
- TI-2023-13478 vm2 Sandbox Escape vulnerability CVSS 3.1CRITICAL 10.0
- TI-2026-63070 vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species CVSS 4.0CRITICAL 10.0
- TI-2026-63067 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function CVSS 4.0CRITICAL 10.0
- TI-2026-62623 vm2 before 3.11.6 Process-wide State Exposure via os and dns CVSS 4.0CRITICAL 10.0
- TI-2026-62618 vm2 before 3.11.8 Sandbox Escape via NodeVM CVSS 4.0CRITICAL 10.0
Sources
- CVE-2026-47137 · CVE Program
- CVE-2026-47137 · NVD
- FIRST EPSS
- GHSA-m4wx-m65x-ghrr · GitHub Advisory Database · CC BY 4.0
- CVE-2026-47137 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences