CVE-2026-47141 Security Details

CVE ID

CVE-2026-47141

CWE

CWE-668

CVE Description

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they are allowed through require.builtin. The diagnostics_channel, async_hooks, and perf_hooks builtins are not blocked by the dangerous builtin denylist. These modules are process-wide, not sandbox-local. Sandboxed code can use them to observe host application data across the vm2 boundary. This issue has been patched in version 3.11.4.

Published

Jun 2, 2026

CVSS Score & Severity

6.9Medium

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

EPSS Score

0.040%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

addDefaultBuiltin()

JSVulnerable params: 1

anon{22,8,0dcbfec,f}/_prepareRequire/_require()

JS

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · patriksimek/vm2PROJECT