THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-m283-3h24-438v (critical) — VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

[GHSA] GHSA-m283-3h24-438v (critical) — VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

medgithub_advisoriesPublished 2026-08-17

GHSA-m283-3h24-438v Severity: critical CVE: CVE-2026-47686

VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

**Affected:** vm2 <= 3.11.3 **CVSS 3.1:** 9.9 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) **CWE:** CWE-693 (Protection Mechanism Failure) **Prerequisite:** Embedder exposes a host function that throws an Error with `.cause` referencing a powerful host obj

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-m283-3h24-438v