Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
CriticalPublic exploit

vm2 NodeVM patch bypass for CVE-2023-37903 leading to sandbox escape

IdentifiersCVE-2026-47137CWE-697

CVE-2026-47137 is a patch-bypass vulnerability in the vm2 Node.js sandbox library affecting versions prior to 3.11.4. A prior fix for CVE-2023-37903 added a guard in nodevm.js intended to block the unsafe NodeVM configuration combination of nesting: true with require: false. However, the check used strict equality against false (options.require === false). An attacker can trivially bypass this guard by omitting the require option entirely, causing options.require to be undefined during the check so the protection is skipped. Immediately afterward, destructuring assigns the default require value to false, recreating the exact unsafe state the patch was meant to prevent. In this condition, sandboxed code can load vm2 inside the sandbox, create a nested VM, and escape the sandbox boundary to reach host execution primitives.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation results in complete sandbox escape and host-side remote code execution. An attacker who can execute JavaScript inside a vulnerable NodeVM instance can instantiate an inner NodeVM, obtain access to child_process, and execute arbitrary operating system commands on the host. This can lead to compromise of server secrets, local files, credentials, tokens, processes, and connected application data stores.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrade is not possible, avoid vulnerable NodeVM configurations that enable nesting:true, especially where the require option is omitted. As an interim reduction measure, explicitly secure require handling and disable or avoid nesting:true where possible. However, the available content indicates there are no effective configuration-based workarounds for environments that execute untrusted scripts, so mitigation is limited and should not be considered a substitute for upgrading.

Remediation

Patch, then assume compromise.

Upgrade vm2 to version 3.11.4 or later. The vulnerable behavior is patched in 3.11.4. Because this issue is a bypass of a prior security fix and the content states there are no effective configuration-only workarounds when untrusted scripts are allowed to run, patching should be treated as the primary remediation.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3

Community discussion across Reddit, Mastodon, and other social sources.

vm2 NodeVM patch bypass for CVE-2023-37903 leading to sandbox escape (CVE-2026-47137) | Mallory