Read the docs
TI-2026-34797 Aliases CVE-2026-47209GHSA-c4cf-2hgv-2qv6

vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain

Priority HIGH 76CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-693.

Summary

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in bridge.js (line 1231) ignores the receiver parameter and unconditionally writes to the host target object. Per the Proxy set trap specification, when receiver !== proxy (e.g., when a child object inherits from the proxy via Object.create), the property assignment should create an own property on the receiver, not on the proxy target. The current implementation always calls otherReflectSet(object, key, value) against the host target, causing all inherited property writes to leak through to the host object. This bug provides an alternative attack vector for writing dangerous cross-realm Symbol keys (e.g., nodejs.util.promisify.custom) to host objects, bypassing any future per-trap isDangerousCrossRealmSymbol guard on the direct set path. This issue has been patched in version 3.11.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00287 21st percentileScored 2026-11-07
Fix Fixed vm2 (patriksimek): 3.11.4vm2 (npm): 3.11.4Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
patriksimekvm2before 3.11.43.11.4Patch availableCNA
—vm2 (npm)before 3.11.43.11.4Patch availableGHSA-c4cf-2hgv-2qv6
  • vm2 Vendorpatriksimek Affected before 3.11.4 Fixed in 3.11.4 Patch available CNA
  • vm2 (npm) Vendor— Affected before 3.11.4 Fixed in 3.11.4 Patch available GHSA-c4cf-2hgv-2qv6

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:*:*:*——patriksimek
  • cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:*:*:* Versions — — ·patriksimek

Remediation

  • Fix · CNA vm2 (patriksimek) Fixed in 3.11.4
  • Fix · GHSA-c4cf-2hgv-2qv6 vm2 (npm) Fixed in 3.11.4 Advisory →

Red Hat 2 advisories

  • RHSA-2026:50850 Released 2026-08-05 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.1 security update
    • Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:33574 Released 2026-06-30 · Red Hat rating Important
    Red Hat Developer Hub 1.9.6 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2.1Fixed RHSA-2026:50850
Red Hat Developer Hub 1.9Fixed RHSA-2026:33574
Not affected: 1 product
  • Red Hat Developer Hub 1.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47209
  2. 2026-10-03 Alias added: GHSA-c4cf-2hgv-2qv6

References

Advisory 1

Other 4

  • TI-2023-14382 Sandbox Escape in vm2 CVSS 3.1CRITICAL 10.0
  • TI-2023-13478 vm2 Sandbox Escape vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2026-63070 vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species CVSS 4.0CRITICAL 10.0
  • TI-2026-63067 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function CVSS 4.0CRITICAL 10.0
  • TI-2026-62623 vm2 before 3.11.6 Process-wide State Exposure via os and dns CVSS 4.0CRITICAL 10.0
  • TI-2026-62618 vm2 before 3.11.8 Sandbox Escape via NodeVM CVSS 4.0CRITICAL 10.0
See all 80 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences