CVE-2026-47140CWE-693

vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

Critical · published June 12, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
56.9
In the wild
Unconfirmed
What it is

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00823 · 56.9th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2026-06-12T14:16Z
EPSS history
Timeline
  • 12 JUN 14:16Z
    vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
    cvelistv5