CVE-2026-47141 | THREATINT

Description

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they are allowed through require.builtin. The diagnostics_channel, async_hooks, and perf_hooks builtins are not blocked by the dangerous builtin denylist. These modules are process-wide, not sandbox-local. Sandboxed code can use them to observe host application data across the vm2 boundary. This issue has been patched in version 3.11.4.

PUBLISHED Reserved 2026-05-18 | Published 2026-06-12 | Updated 2026-06-13 | Assigner GitHub_M

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-668: Exposure of Resource to Wrong Sphere

Product status

< 3.11.4

affected

References

github.com/...ek/vm2/security/advisories/GHSA-9g8x-92q2-p28f exploit

github.com/...ek/vm2/security/advisories/GHSA-9g8x-92q2-p28f

github.com/...ommit/e1c48fce05189f48e71efbd32af0754efa4066bb

github.com/patriksimek/vm2/releases/tag/v3.11.4

cve.org (CVE-2026-47141)

nvd.nist.gov (CVE-2026-47141)

Download JSON