CVE-2026-47141
MEDIUM SEVERITYVulnerability Description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they are allowed through require.builtin. The diagnostics_channel, async_hooks, and perf_hooks builtins are not blocked by the dangerous builtin denylist. These modules are process-wide, not sandbox-local. Sandboxed code can use them to observe host application data across the vm2 boundary. This issue has been patched in version 3.11.4.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-668
Source
GitHub
Vendor
npm
Product
vm2
Discussion (0)
Add Comment
No comments yet. Be the first!