{"action":"Upgrade vm2 to 3.11.4 or later.","affected":[{"fixed":"3.11.4","introduced":"0"}],"component":"vm2","cve_ids":["CVE-2026-47209"],"ecosystem":"npm","epss":0.00287,"exploited":false,"fixed_versions":["3.11.4"],"ghsa_id":"GHSA-c4cf-2hgv-2qv6","id":"tcs_01M5KFHPQ6490D09HX0JJ22FN5","modified_at":"2026-06-12T19:45:09.843541948Z","published_at":"2026-05-29T17:49:18Z","references":["https://osv.dev/vulnerability/GHSA-c4cf-2hgv-2qv6","https://github.com/patriksimek/vm2/security/advisories/GHSA-c4cf-2hgv-2qv6","https://nvd.nist.gov/vuln/detail/CVE-2026-47209","https://github.com/patriksimek/vm2/commit/26d0318b5e6555be4b187ba05d6cf378ccecfe22","https://github.com/patriksimek/vm2","https://github.com/patriksimek/vm2/releases/tag/v3.11.4"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-c4cf-2hgv-2qv6","url":"https://osv.dev/vulnerability/GHSA-c4cf-2hgv-2qv6"}],"summary":"vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain"}