CVE-2026-47137

The patch introduced for CVE-2023-37903 added a check in the nodevm.js file (line 263) blocking the combination of 'nesting: true' and 'require: false' options. However, the check uses strict comparison (options.require === false), which does not detect the case when the 'require' option is not provided at all — in that case its value is 'undefined', not 'false', so the protective condition is not met. Directly after this check (line 280), destructuring with a default value 'require: requireOpts = false' assigns the value 'false' to the requireOpts variable, recreating precisely that configuration which the patch was supposed to protect against. As a result, an attacker, by omitting the 'require' option, can cause the sandbox to run in a configuration that should be blocked.

An attacker can escape from the isolated vm2 sandbox environment and execute arbitrary code in the context of the host Node.js process, gaining full control over server resources (confidentiality, integrity, and availability — all rated as HIGH in the CVSS vector with scope changed to Scope: Changed).

The vm2 library should be updated to version 3.11.4 or newer, in which the bug has been fixed. Details are available in vendor references (GitHub release v3.11.4 and security advisory GHSA-m4wx-m65x-ghrr).

The vm2 library in versions before 3.11.4 (all versions in which the patch for GHSA-8hg8-63c5-gwmx / CVE-2023-37903 was applied, i.e., from the introduction of the faulty check until release 3.11.4).