{"vulnerability": "cve-2026-47686", "sightings": [{"uuid": "58d9c36c-95f8-4cd2-94bf-2c4bd2611bad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-47686", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mtjdcq7hyb2u", "content": "A vm2 sandbox escape (CVE-2026-47686, CVSS 9.9) with public PoC lets attackers hijack the host. Two more critical flaws also patched. Update to 3.11.6.\n\n#vm2 #CVE202647686 #SandboxEscape #RCE #NodeJS #InfoSec", "creation_timestamp": "2026-08-20T13:15:47.895625Z"}, {"uuid": "1f04217c-1445-4e48-834c-c2e7dbdb0a9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-47686", "type": "seen", "source": "https://bsky.app/profile/yetikamp.bsky.social/post/3mtez5areo52r", "content": "CVE-2026-47686: vm2 sandbox escape via unsanitized SuppressedError. Node.js devs, your \"secure\" isolation is just a suggestion. Patch to 3.11.6 immediately.", "creation_timestamp": "2026-08-18T20:03:06.944016Z"}, {"uuid": "a4f5aebc-246c-444b-88f1-72b449b1366f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-47686", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtcj2snb5t2u", "content": "CVE-2026-47686 - vm2\nA vulnerability in VM2 versions up to 3.11.3 allows malicious code to escape the sandbox and execute arbitrary commands on the host system. This is because VM2 does not properly sanitize the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #npm #CVE #infosec", "creation_timestamp": "2026-08-17T20:10:08.983945Z"}, {"uuid": "15350afc-8a01-46a7-ac0e-24fe64a50120", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-47686", "type": "published-proof-of-concept", "source": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m283-3h24-438v", "content": "", "creation_timestamp": "2026-08-17T20:35:14.082781Z"}, {"uuid": "bf72eb83-7f69-4686-8e03-faaaf2883ff3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-47686", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtcpnvyjti2f", "content": "\ud83d\udea8 CVE-2026-47686 \u2014 CVSS 9.9 CRITICAL\n\nvm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sa...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-47686\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-17T22:08:09.207524Z"}]}