{"id":"CVE-2026-47140","aliases":["CLSA-2026-1787860907","EUVD-2026-36446","GHSA-2cm2-m3w5-gp2f","GHSA-m5w8-4gq2-6f8x","GHSA-q3fm-4wcw-g57x","GHSA-rp36-8xq3-r6c4","GHSA-v836-6xw4-9cx3","ROOT-APP-NPM-CVE-2026-47140"],"status":"published","title":"vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution","description":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00978,"percentile":0.62467,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2026-05-29T17:59:23Z","modified":"2026-10-28T02:31:11Z","fixes":[{"ecosystem":"npm","package":"vm2","fixed_in":["3.11.4"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"vm2","fixed_in":["3.9.17-aikido.11","3.9.17-aikido.12","3.11.3-aikido.1","3.11.3-aikido.2","3.9.17-aikido.13","3.11.3-aikido.3","3.9.17-aikido.7","3.9.17-aikido.8","3.9.17-aikido.9","3.9.17-aikido.10","3.9.7-aikido.5","3.9.7-aikido.6"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/vm2","fixed_in":["3.9.17-root.io.11","3.9.17-root.io.12","3.11.3-root.io.1","3.11.3-root.io.2","3.9.17-root.io.13","3.11.3-root.io.3","3.9.17-root.io.7","3.9.17-root.io.8","3.9.17-root.io.9","3.9.17-root.io.10","3.9.7-root.io.5","3.9.7-root.io.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.11.3"},{"fixed":"3.11.4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10.0-tuxcare.0"},{"fixed":"3.10.0-tuxcare.1"}]}],"versions":["3.10.0"],"bundled":30},{"source":"osv","ecosystem":"npm","package":"vm2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.17-aikido.11"},{"fixed":"3.9.17-aikido.12"},{"fixed":"3.11.3-aikido.1"},{"fixed":"3.11.3-aikido.2"},{"fixed":"3.9.17-aikido.13"},{"fixed":"3.11.3-aikido.3"},{"fixed":"3.9.17-aikido.7"},{"fixed":"3.9.17-aikido.8"},{"fixed":"3.9.17-aikido.9"},{"fixed":"3.9.17-aikido.10"},{"fixed":"3.9.7-aikido.5"},{"fixed":"3.9.7-aikido.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.17-root.io.11"},{"fixed":"3.9.17-root.io.12"},{"fixed":"3.11.3-root.io.1"},{"fixed":"3.11.3-root.io.2"},{"fixed":"3.9.17-root.io.13"},{"fixed":"3.11.3-root.io.3"},{"fixed":"3.9.17-root.io.7"},{"fixed":"3.9.17-root.io.8"},{"fixed":"3.9.17-root.io.9"},{"fixed":"3.9.17-root.io.10"},{"fixed":"3.9.7-root.io.5"},{"fixed":"3.9.7-root.io.6"}]}]}],"products":[{"vendor":"patriksimek","product":"vm2"}],"references":[{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-rp36-8xq3-r6c4","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/patriksimek/vm2/commit/a1ed47a98d1cc36cb48c0d566d55889688e0b59b","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.4","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47140","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rp36-8xq3-r6c4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47140.json","tags":["advisory"]},{"url":"https://github.com/patriksimek/vm2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-47140","title":"vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution","description":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.","status":"published","published":"2026-06-12T14:16:10.727Z","modified":"2026-06-13T03:55:57.896Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-36446","description":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.","status":"published","published":"2026-06-12T14:16:10Z","modified":"2026-06-13T03:55:57Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:43.222Z"}],"ghsa":[{"id":"GHSA-rp36-8xq3-r6c4","title":"NodeVM builtin denylist bypass via process and inspector/promises allows host code execution","description":"## Summary\n\n`NodeVM` blocks several dangerous Node.js builtins such as `module`, `worker_threads`, `cluster`, `vm`, `repl`, and `inspector`.\n\nHowever, the denylist misses `process` and `inspector/promises`. Both can be used from sandboxed code to reach host-side execution primitives.\n\nThis allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process.\n\n## Details\n\nThe dangerous builtin denylist is defined in `lib/builtin.js`. This list does not include:\n\n```text\nprocess\ninspector/promises\n```\n\nNon-denied builtins are exposed to the sandbox through:\n\n```js\nbuiltins.set(key, special ? special : vm =\u003e vm.readonly(hostRequire(key)));\n```\n\nBecause of this, sandboxed code can bypass the expected restrictions in two ways:\n\n1. `require('process').getBuiltinModule('child_process')` reloads `child_process`, even when `child_process` is excluded.\n2. `require('inspector/promises')` exposes the Inspector protocol and can call `Runtime.evaluate` in the host process.\n\n## PoC\n\nTested on:\n\n```text\nvm2: 3.11.2\nNode.js: v25.9.0\n```\n\nRun from the vm2 repository root:\n\n```bash\nnode poc/dangerous-builtin-denylist-rce.js\n```\n[dangerous-builtin-denylist-rce.js](https://github.com/user-attachments/files/27570113/dangerous-builtin-denylist-rce.js)\n\n\nThe PoC first confirms the intended restrictions work:\n\n```text\nrequire(\"inspector\"): BLOCKED\nrequire(\"child_process\"): BLOCKED\n```\n\nThen it bypasses them:\n\n```text\nrequire(\"process\").getBuiltinModule(\"child_process\").execFileSync(...)\n```\n\nThis spawns a host child process. It also confirms:\n\n```text\nrequire(\"inspector/promises\").Session().post(\"Runtime.evaluate\", ...)\n```\n\nThis evaluates JavaScript in the host process.\n\n\u003cimg width=\"858\" height=\"766\" alt=\"Screenshot 2026-05-10 at 11 53 33 AM\" src=\"https://github.com/user-attachments/assets/7614aecb-5ffd-4c41-bfe8-e1fcb3b1bb59\" /\u003e\n\n## Impact\n\nAn attacker who can run untrusted JavaScript inside `NodeVM` with affected builtin settings can escape the sandbox and execute arbitrary code in the host process.\n\nThis can lead to full compromise of the application process, including reading files, writing files, spawning processes, and accessing host environment secrets.\n\n(This is not reachable with the default NodeVM configuration where require is disabled or no affected builtins are allowed. It affects applications that allow process, inspector/promises, or the wildcard \"*\" in require.builtin.)\n\n## Suggested fix\n\nAdd `process` and `inspector/promises` to the dangerous builtin blocklist.\n\nAlso consider blocking dangerous builtin families by prefix, for example blocking both:\n\n```text\ninspector\ninspector/*\n```\n\ninstead of only exact module names.","status":"published","published":"2026-05-29T17:59:23Z","modified":"2026-06-12T20:56:50Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:40:27.329706Z"}],"nvd":[{"id":"CVE-2026-47140","description":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.","status":"published","published":"2026-06-12T15:16:28.4Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:12:23.846948Z"}],"osv":[{"id":"CVE-2026-47140","title":"vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution","description":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.","status":"published","published":"2026-06-12T14:16:10.727Z","modified":"2026-10-28T02:31:11.774168537Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:45:06.231145Z"},{"id":"GHSA-rp36-8xq3-r6c4","title":"NodeVM builtin denylist bypass via process and inspector/promises allows host code execution","description":"## Summary\n\n`NodeVM` blocks several dangerous Node.js builtins such as `module`, `worker_threads`, `cluster`, `vm`, `repl`, and `inspector`.\n\nHowever, the denylist misses `process` and `inspector/promises`. Both can be used from sandboxed code to reach host-side execution primitives.\n\nThis allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process.\n\n## Details\n\nThe dangerous builtin denylist is defined in `lib/builtin.js`. This list does not include:\n\n```text\nprocess\ninspector/promises\n```\n\nNon-denied builtins are exposed to the sandbox through:\n\n```js\nbuiltins.set(key, special ? special : vm =\u003e vm.readonly(hostRequire(key)));\n```\n\nBecause of this, sandboxed code can bypass the expected restrictions in two ways:\n\n1. `require('process').getBuiltinModule('child_process')` reloads `child_process`, even when `child_process` is excluded.\n2. `require('inspector/promises')` exposes the Inspector protocol and can call `Runtime.evaluate` in the host process.\n\n## PoC\n\nTested on:\n\n```text\nvm2: 3.11.2\nNode.js: v25.9.0\n```\n\nRun from the vm2 repository root:\n\n```bash\nnode poc/dangerous-builtin-denylist-rce.js\n```\n[dangerous-builtin-denylist-rce.js](https://github.com/user-attachments/files/27570113/dangerous-builtin-denylist-rce.js)\n\n\nThe PoC first confirms the intended restrictions work:\n\n```text\nrequire(\"inspector\"): BLOCKED\nrequire(\"child_process\"): BLOCKED\n```\n\nThen it bypasses them:\n\n```text\nrequire(\"process\").getBuiltinModule(\"child_process\").execFileSync(...)\n```\n\nThis spawns a host child process. It also confirms:\n\n```text\nrequire(\"inspector/promises\").Session().post(\"Runtime.evaluate\", ...)\n```\n\nThis evaluates JavaScript in the host process.\n\n\u003cimg width=\"858\" height=\"766\" alt=\"Screenshot 2026-05-10 at 11 53 33 AM\" src=\"https://github.com/user-attachments/assets/7614aecb-5ffd-4c41-bfe8-e1fcb3b1bb59\" /\u003e\n\n## Impact\n\nAn attacker who can run untrusted JavaScript inside `NodeVM` with affected builtin settings can escape the sandbox and execute arbitrary code in the host process.\n\nThis can lead to full compromise of the application process, including reading files, writing files, spawning processes, and accessing host environment secrets.\n\n(This is not reachable with the default NodeVM configuration where require is disabled or no affected builtins are allowed. It affects applications that allow process, inspector/promises, or the wildcard \"*\" in require.builtin.)\n\n## Suggested fix\n\nAdd `process` and `inspector/promises` to the dangerous builtin blocklist.\n\nAlso consider blocking dangerous builtin families by prefix, for example blocking both:\n\n```text\ninspector\ninspector/*\n```\n\ninstead of only exact module names.","status":"published","published":"2026-05-29T17:59:23Z","modified":"2026-06-12T21:15:15.795234843Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"ROOT-APP-NPM-CVE-2026-47140","title":"CVE-2026-47140 in vm2 - Patched by Root","description":"Root has patched CVE-2026-47140 in the vm2 package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-30T06:02:29Z","modified":"2026-09-30T07:15:07.777228562Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"CLSA-2026-1787860907","title":"TuxCare security update for vm2 (34 CVEs)","description":"TuxCare rebuilt vm2 to address 34 CVEs. Fixed in 3.10.0-tuxcare.1.","status":"published","published":"2026-08-27T20:01:47Z","modified":"2026-10-15T09:48:03.095721636Z","updated_at":"2026-11-02T15:43:47.591214Z"}]}}