Protection Mechanism Failure in vm2 - CVE-2026-47209
Published: May 18, 2026
Vulnerability identifier: #VU131737
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-47209
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject properties into host objects via the prototype chain.
The vulnerability exists due to improper access control in the BaseHandler.set trap in bridge.js when handling inherited property assignments on proxy-backed objects. A remote attacker can create a prototype-inheriting child object and assign crafted properties to inject properties into host objects via the prototype chain.
Dangerous Symbol-keyed properties can be written to host objects, which can lead to semantic confusion across realms.
Affected software
vm2
How to mitigate CVE-2026-47209
Install security update from vendor's website.
vm2 - update to 3.11.4