CVE Explorer
CVE-2026-47137
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) introduced a check in nodevm.js line 263 that blocks the combination nesting: true + require: false. However, the check uses strict equality (options.require === false), which is trivially bypassed by omitting the require option entirely. When require is not specified, options.require is undefined, not false. The strict equality check fails, so the security guard is skipped. Im
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"vm2","vendor":"patriksimek","versions":[{"status":"affected","version":"< 3.11.4"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:8fb93fd677efe2ee71fca4a9de65b62654510dc85df5afc550aaad76d4df9e6a · sha256:90f91ce15fa67b4a… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:8fb93fd677efe2ee71fca4a9de65b62654510dc85df5afc550aaad76d4df9e6a · sha256:90f91ce15fa67b4a… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-913","description":"CWE-913: Improper Control of Dynamically-Managed Code Resources","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:8fb93fd677efe2ee71fca4a9de65b62654510dc85df5afc550aaad76d4df9e6a · sha256:90f91ce15fa67b4a… · /containers/cna/problemTypes/0/descriptions/0
Source references
5 source assertions{"name":"https://github.com/advisories/GHSA-g644-9gfx-q4q4","tags":["x_refsource_MISC"],"url":"https://github.com/advisories/GHSA-g644-9gfx-q4q4"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:8fb93fd677efe2ee71fca4a9de65b62654510dc85df5afc550aaad76d4df9e6a · sha256:90f91ce15fa67b4a… · /containers/cna/references/3
{"name":"https://github.com/patriksimek/vm2/commit/01a7552add345d5a6862623884e6b79a85bf0568","tags":["x_refsource_MISC"],"url":"https://github.com/patriksimek/vm2/commit/01a7552add345d5a6862623884e6b79a85bf0568"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:8fb93fd677efe2ee71fca4a9de65b62654510dc85df5afc550aaad76d4df9e6a · sha256:90f91ce15fa67b4a… · /containers/cna/references/1
{"name":"https://github.com/patriksimek/vm2/commit/86ab819f202c3a8dad88cef5705f2e416c5188d7","tags":["x_refsource_MISC"],"url":"https://github.com/patriksimek/vm2/commit/86ab819f202c3a8dad88cef5705f2e416c5188d7"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:8fb93fd677efe2ee71fca4a9de65b62654510dc85df5afc550aaad76d4df9e6a · sha256:90f91ce15fa67b4a… · /containers/cna/references/2
{"name":"https://github.com/patriksimek/vm2/releases/tag/v3.11.4","tags":["x_refsource_MISC"],"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.4"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:8fb93fd677efe2ee71fca4a9de65b62654510dc85df5afc550aaad76d4df9e6a · sha256:90f91ce15fa67b4a… · /containers/cna/references/4
{"name":"https://github.com/patriksimek/vm2/security/advisories/GHSA-m4wx-m65x-ghrr","tags":["x_refsource_CONFIRM"],"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-m4wx-m65x-ghrr"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:8fb93fd677efe2ee71fca4a9de65b62654510dc85df5afc550aaad76d4df9e6a · sha256:90f91ce15fa67b4a… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.