Loading vulnerability…
vm2 NodeVM builtin denylist bypass enabling sandbox escape
CVE-2026-47140 is a sandbox-escape vulnerability in vm2 versions before 3.11.4. NodeVM's dangerous-builtin denylist omits process, while exact-match filtering of inspector fails to block its inspector/promises submodule. When require is enabled and the builtin allowlist permits either affected module or wildcard access, sandboxed JavaScript can access host-side execution primitives. On Node.js 22 or later, process.getBuiltinModule can expose child_process; inspector/promises can expose a V8 Inspector Session whose Runtime.evaluate method executes JavaScript in the host context. The default NodeVM configuration is not vulnerable to this specific bypass. Version 3.11.4 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker able to execute JavaScript in an affected NodeVM configuration can escape the sandbox and execute arbitrary JavaScript or operating-system commands with the host process's privileges. Potential consequences include reading and modifying host-accessible files, spawning processes, and accessing environment secrets. The resulting access is not confined to the intended sandbox boundary.
If you can’t patch tonight, do this now.
Until the upgrade is deployed, keep NodeVM require disabled where possible. Otherwise, remove process, inspector/promises, and wildcard "*" from require.builtin, restrict exposed builtins to a reviewed allowlist, and block dangerous builtin families and their submodules. These restrictions address this specific bypass and do not replace patching for other vm2 sandbox-escape vulnerabilities.
Patch, then assume compromise.
Upgrade vm2 to version 3.11.4 or later and update dependent packages as necessary to ensure the patched version is used. The fix adds process to the dangerous-builtin set and replaces exact-match filtering with builtin-family matching that normalizes node: prefixes and blocks dangerous submodules. Filtering applies to both wildcard expansion and explicit builtin allowlist entries.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.