Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-47137: vm2 sandbox may run malicious code
CVE-2026-47137 · published 3 days ago
Summary
The vm2 JavaScript sandbox library, used in GitHub Actions and the @rootio/vm2 package, can be tricked into running code that should be isolated. A specially crafted input could let an attacker execute commands on the server. Install the latest version of vm2 that contains the fix.
What to do
- Update GitHub Actions vm2 to version 3.11.4.
- Update GitHub Actions vm2 to version 3.11.3-aikido.1.
- Update rootio @rootio/vm2 to version 3.11.3-root.io.1.
- Update GitHub Actions vm2 to version 3.11.3-aikido.2.
- Update rootio @rootio/vm2 to version 3.11.3-root.io.2.
- Update GitHub Actions vm2 to version 3.9.17-aikido.7.
- Update rootio @rootio/vm2 to version 3.9.17-root.io.7.
- Update vm2 to version 3.9.17-aikido.10.
- Update rootio @rootio/vm2 to version 3.9.17-root.io.10.
- Update rootio @rootio/vm2 to version 3.9.17-root.io.9.
- Update GitHub Actions vm2 to version 3.9.17-aikido.9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | vm2 |
<= 3.11.3 Fix: upgrade to 3.11.4
|
| Root:npm | GitHub Actions | vm2 |
< 3.11.3-aikido.1 < 3.11.3-aikido.2 < 3.9.17-aikido.7 < 3.9.17-aikido.9 Fix: upgrade to 3.11.3-aikido.1
|
| Root:npm | rootio | @rootio/vm2 |
< 3.11.3-root.io.1 < 3.11.3-root.io.2 < 3.9.17-root.io.7 < 3.9.17-root.io.10 < 3.9.17-root.io.9 Fix: upgrade to 3.11.3-root.io.1
|
| Root:npm | – | vm2 |
< 3.9.17-aikido.10 Fix: upgrade to 3.9.17-aikido.10
|
Original advisory text
CVE-2026-47137 in vm2 - Patched by Root
Root has patched CVE-2026-47137 in the vm2 package for Root:npm. Multiple fixed versions available.
References
- https://github.com/patriksimek/vm2/security/advisories/GHSA-m4wx-m65x-ghrr
- https://github.com/patriksimek/vm2/commit/01a7552add345d5a6862623884e6b79a85bf05...
- https://github.com/patriksimek/vm2/commit/86ab819f202c3a8dad88cef5705f2e416c5188...
- https://github.com/patriksimek/vm2/releases/tag/v3.11.4
- https://github.com/advisories/GHSA-m4wx-m65x-ghrr
- https://github.com/advisories/GHSA-g644-9gfx-q4q4
- https://nvd.nist.gov/vuln/detail/CVE-2026-47137
Severity
10.0
Critical
CVSS 3.1: 10.0 (GHSA)
CVSS 3.1: 10.0 (OSV)
Exploitation
EPSS <1%
Type
CWE-913Improper Control of Dynamically-Managed Code Resources
Timeline
Published22 Sep 2026
Updated25 Sep 2026
First seen29 May 2026
Track software like this
Free during beta