CVE-2026-47141
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk12th percentile — higher than 12% of all known CVEs
Summary
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins that can be used by sandboxed code to observe host application data.
Risk Assessment
Allowing access to process-wide observability modules may lead to data leakage and security breaches. Sandboxed code may inadvertently access sensitive information.
Recommendation
It is recommended to upgrade to version 3.11.4 or later to block access to dangerous builtins. Additionally, review sandboxed code for potential security vulnerabilities.
Original NVD description (English source)
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they are allowed through require.builtin. The diagnostics_channel, async_hooks, and perf_hooks builtins are not blocked by the dangerous builtin denylist. These modules are process-wide, not sandbox-local. Sandboxed code can use them to observe host application data across the vm2 boundary. This issue has been patched in version 3.11.4.