CVE-2026-47140

CRITICAL10.0

vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

Published Jun 12, 2026

Modified 1 weeks ago

Details

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.

References

WEB

https://github.com/patriksimek/vm2/commit/a1ed47a98d1cc36cb48c0d566d55889688e0b59b

WEB

https://github.com/patriksimek/vm2/releases/tag/v3.11.4

DETECTION

https://github.com/patriksimek/vm2/security/advisories/GHSA-rp36-8xq3-r6c4

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-47140

CVSS Analysis

CVSS v3.1

10.0