CVE-2026-47137: vm2 Sandbox Escape via Strict Equality require Bypass (CVSS 10.0)

CVE-2026-47137: vm2 Sandbox Escape via Strict Equality require Bypass

A maximum-severity sandbox escape tracked as CVE-2026-47137 has been identified in vm2, the popular Node.js sandbox library. With a CVSS v3.1 score of 10.0 (Critical), this flaw allows attackers to circumvent the require: false security restriction and escape the vm2 sandbox to execute arbitrary code on the host Node.js process.

The root cause is a strict equality check bug introduced in the fix for a prior CVE (GHSA-8hg8-63c5-gwmx / CVE-2023-37903). The mitigation used options.require === false (strict equality) instead of a truthy/falsy check, meaning any other falsy value for require — such as 0, "", null, or undefined — passes the guard and enables the restricted code path.

This vulnerability is patched in vm2 3.11.4.

Vulnerability Overview

Background: The Prior Fix and Its Flaw

The Original CVE-2023-37903 Fix

The prior fix for CVE-2023-37903 (GHSA-8hg8-63c5-gwmx) added a check in nodevm.js at line 263 to block a dangerous combination:

nesting: true + require: false

The intent was: if nesting is enabled AND require is explicitly disabled, the combination is blocked because it represented a known sandbox escape path.

The check was written as:

// nodevm.js line 263 — the flawed check
if (options.nesting === true && options.require === false) {
  throw new Error("...");  // Block the dangerous combination
}

Why === false Is Insufficient

The === false strict equality check only matches the literal boolean false. JavaScript has many falsy values that evaluate to false in conditionals but do not equal false under strict equality:

This means an attacker can supply require: 0 or require: null to satisfy vm2's interpretation of "require is disabled" while still passing through the guard:

// Attacker bypasses the security check:
const {NodeVM} = require('vm2');
const vm = new NodeVM({
  nesting: true,
  require: 0  // Falsy but not === false → bypasses the guard
});
vm.run(`
  // Now inside a vm2 with nesting: true and effectively no require restriction
  // Can use nesting to reach host realm...
`);

Technical Exploitation Path

The bypass works because:

1. options.require === false evaluates to false when require is 0, null, "", etc.
2. The block is not executed — the "dangerous combination" guard is skipped
3. The nesting: true path continues, which was the vector for the original CVE-2023-37903 escape
4. The attacker re-uses the original nesting-based escape technique that the patch was intended to block

In effect, the fix for CVE-2023-37903 contained a logic error that makes it trivially bypassable with a one-character change to the payload.

Impact Assessment

Detection

Look for vm2 initialization with non-boolean falsy values for require:

# Audit your codebase for potentially bypassed vm2 options
grep -r "require:" . --include="*.js" --include="*.ts" | grep -E "require:\s*(0|null|undefined|\"\")"

Also audit transitive dependencies:

npm ls vm2
# or
yarn why vm2

Remediation

Upgrade vm2 to 3.11.4

npm update vm2
# or
yarn upgrade vm2

The fix in 3.11.4 changes the check to properly handle all falsy values:

// Fixed check (conceptual):
if (options.nesting === true && !options.require) {
  throw new Error("...");  // Catches all falsy require values
}

Consider Structural Mitigations

If you cannot immediately upgrade, consider:

1. Validate require option type before passing to vm2:

   const requireOpt = typeof options.require === 'boolean' ? options.require : false;
   const vm = new NodeVM({ require: requireOpt });

   Copy

2. Disable nesting entirely if not needed — the dangerous combination requires nesting: true.

3. Migrate to OS-level isolation for untrusted code execution (Worker Threads, containers, Deno).

Related CVEs in This Batch

This is one of four vm2 sandbox escapes all fixed in version 3.11.4:

Key Takeaways

1. CVE-2026-47137 is a CVSS 10.0 logic bypass — changing require: false to require: 0 defeats vm2's own CVE-2023-37903 patch
2. Strict equality (===) checks against false are dangerous when you intend "falsy" — always use !value or explicitly check the type
3. All vm2 versions prior to 3.11.4 are vulnerable, regardless of prior CVE remediation
4. The low exploit complexity (one character change) means weaponized PoCs for the original CVE likely already bypass this
5. Upgrade to vm2 3.11.4 or migrate to stronger sandboxing primitives

Sources

• CVE-2026-47137 — NIST NVD
• vm2 on npm
• GHSA-8hg8-63c5-gwmx — Prior CVE-2023-37903 Advisory
• CWE-697: Incorrect Comparison