CVE-2026-47137: vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE

Synopsis

A patch-bypass vulnerability in the vm2 Node.js sandbox library allows an attacker to achieve full remote code execution by exploiting a logic flaw in the security guard introduced by a prior fix (CVE-2023-37903). The affected code uses strict equality to check for a blocked configuration, but omitting the relevant option entirely causes the check to be skipped, reproducing the exact dangerous state the patch was meant to prevent. Exploitation requires no authentication and is reachable over the network, giving an attacker complete control over confidentiality, integrity, and availability of the host. A patched-image rebuild at vm2 version 3.11.4 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable vm2 sandbox is exposed over the network; an attacker must be able to reach the service from a remote network location to deliver the malicious payload.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to trigger the vulnerability.

• Victim interactionNot required

  Exploitation is fully automated and does not require any action from a user or administrator on the target system.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory-layout dependencies, or environmental prerequisites must be satisfied.

Blast Radius

• A successful attacker escapes the vm2 sandbox entirely and executes arbitrary code with the privileges of the host Node.js process.
• All data accessible to the process is readable, including environment variables, secrets, credentials, and in-memory session tokens.
• An attacker can write, modify, or delete files and data that the process has access to, corrupting application state or persisted records.
• The attacker can terminate the host process or consume system resources, causing a full service outage for the affected application.