CVE-2026-47137 vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE

🗓️ 12 Jun 2026 14:15:34Reported by GoogleType

osv

osv🔗 osv.dev👁 1 Views

vm2 prior to 3.11.4 allows remote code execution when nesting is true and require is omitted.

Reporter	Title	Published	Views	Family All 18
Circl	CVE-2026-47137	14 Jun 202608:00	–	circl
CVE	CVE-2026-47137	12 Jun 202614:15	–	cve
Cvelist	CVE-2026-47137 vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE	12 Jun 202614:15	–	cvelist
EUVD	EUVD-2026-36443	12 Jun 202614:15	–	euvd
Github Security Blog	vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE	29 May 202617:50	–	github
NVD	CVE-2026-47137	12 Jun 202615:16	–	nvd
OSV	GHSA-G644-9GFX-Q4Q4 vm2 Sandbox Escape vulnerability	13 Jul 202317:01	–	osv
OSV	GHSA-M4WX-M65X-GHRR vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE	29 May 202617:50	–	osv
OSV	MINI-9574-FFQ3-C7X8	2 Jun 202621:51	–	osv
OSV	ROOT-APP-NPM-CVE-2026-47137 CVE-2026-47137 in @rootio/vm2 - Patched by Root	12 Jun 202613:27	–	osv

Source	Link
github	www.github.com/patriksimek/vm2/releases/tag/v3.11.4
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47137.json
github	www.github.com/advisories/GHSA-g644-9gfx-q4q4
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-m4wx-m65x-ghrr
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-47137
github	www.github.com/patriksimek/vm2/commit/01a7552add345d5a6862623884e6b79a85bf0568
github	www.github.com/patriksimek/vm2/commit/86ab819f202c3a8dad88cef5705f2e416c5188d7

08 Jul 2026 08:05Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.110

EPSS0.00382

CVE-2026-47137 vm2 nesting true require omitted remote code execution