CVE-2026-47140

CRITICAL

vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

Title source: cna
STIX 2.1

Description

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.

References (3)

Core 3

Scores

CVSS v3 10.0
EPSS 0.0088
EPSS Percentile 54.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-693
Status published
Products (2)
npm/vm2 0 - 3.11.4npm
patriksimek/vm2 < 3.11.4
Published Jun 12, 2026
Tracked Since Jun 12, 2026