Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-kv67-9wty-p3hc
Vulnerability ID VCID-kv67-9wty-p3hc
Aliases CVE-2026-47209
GHSA-c4cf-2hgv-2qv6
Summary vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-693 Protection Mechanism Failure
System Score Found at
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2026-47209
epss 0.00035 https://api.first.org/data/v1/epss?cve=CVE-2026-47209
epss 0.00049 https://api.first.org/data/v1/epss?cve=CVE-2026-47209
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-c4cf-2hgv-2qv6
cvssv3.1 8.6 https://github.com/patriksimek/vm2
generic_textual HIGH https://github.com/patriksimek/vm2
cvssv3.1 8.6 https://github.com/patriksimek/vm2/commit/26d0318b5e6555be4b187ba05d6cf378ccecfe22
generic_textual HIGH https://github.com/patriksimek/vm2/commit/26d0318b5e6555be4b187ba05d6cf378ccecfe22
ssvc Track https://github.com/patriksimek/vm2/commit/26d0318b5e6555be4b187ba05d6cf378ccecfe22
cvssv3.1 8.6 https://github.com/patriksimek/vm2/releases/tag/v3.11.4
generic_textual HIGH https://github.com/patriksimek/vm2/releases/tag/v3.11.4
ssvc Track https://github.com/patriksimek/vm2/releases/tag/v3.11.4
cvssv3.1 8.6 https://github.com/patriksimek/vm2/security/advisories/GHSA-c4cf-2hgv-2qv6
cvssv3.1_qr HIGH https://github.com/patriksimek/vm2/security/advisories/GHSA-c4cf-2hgv-2qv6
generic_textual HIGH https://github.com/patriksimek/vm2/security/advisories/GHSA-c4cf-2hgv-2qv6
ssvc Track https://github.com/patriksimek/vm2/security/advisories/GHSA-c4cf-2hgv-2qv6
cvssv3.1 8.6 https://nvd.nist.gov/vuln/detail/CVE-2026-47209
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-47209
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-47209
https://github.com/patriksimek/vm2
https://github.com/patriksimek/vm2/commit/26d0318b5e6555be4b187ba05d6cf378ccecfe22
https://github.com/patriksimek/vm2/releases/tag/v3.11.4
https://nvd.nist.gov/vuln/detail/CVE-2026-47209
GHSA-c4cf-2hgv-2qv6 https://github.com/advisories/GHSA-c4cf-2hgv-2qv6
GHSA-c4cf-2hgv-2qv6 https://github.com/patriksimek/vm2/security/advisories/GHSA-c4cf-2hgv-2qv6
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://github.com/patriksimek/vm2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://github.com/patriksimek/vm2/commit/26d0318b5e6555be4b187ba05d6cf378ccecfe22
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-06-12T15:00:52Z/ Found at https://github.com/patriksimek/vm2/commit/26d0318b5e6555be4b187ba05d6cf378ccecfe22
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://github.com/patriksimek/vm2/releases/tag/v3.11.4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-06-12T15:00:52Z/ Found at https://github.com/patriksimek/vm2/releases/tag/v3.11.4
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://github.com/patriksimek/vm2/security/advisories/GHSA-c4cf-2hgv-2qv6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-06-12T15:00:52Z/ Found at https://github.com/patriksimek/vm2/security/advisories/GHSA-c4cf-2hgv-2qv6
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-47209
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.10939
EPSS Score 0.00035
Published At June 13, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:38:55.034852+00:00 GHSA Importer Import https://github.com/advisories/GHSA-c4cf-2hgv-2qv6 38.6.0