Detections
Analytics

SCA: security update for vm2 (GHSA-c4cf-2hgv-2qv6)

high Tenable Self-Hosted Container Security Plugin ID 442533

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in
 bridge.js (line 1231) ignores the receiver parameter and unconditionally writes to the host target object.
 Per the Proxy set trap specification, when receiver !== proxy (e.g., when a child object inherits from the
 proxy via Object.create), the property assignment should create an own property on the receiver, not on
 the proxy target. The current implementation always calls otherReflectSet(object, key, value) against the
 host target, causing all inherited property writes to leak through to the host object. This bug provides
 an alternative attack vector for writing dangerous cross-realm Symbol keys (e.g.,
 nodejs.util.promisify.custom) to host objects, bypassing any future per-trap isDangerousCrossRealmSymbol
 guard on the direct set path. This issue has been patched in version 3.11.4. (CVE-2026-47209)

Solution

Update the vm2 library and its related packages to version 3.11.4 or later.

See Also

https://github.com/advisories/GHSA-c4cf-2hgv-2qv6

Plugin Details

Severity: High

ID: 442533

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 5/30/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 51.26

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-47209

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/29/2026

Vulnerability Publication Date: 5/29/2026

Reference Information

CVE: CVE-2026-47209

cwe: CWE-693