CVE-2026-47141 Details
Description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they are allowed through require.builtin. The diagnostics_channel, async_hooks, and perf_hooks builtins are not blocked by the dangerous builtin denylist. These modules are process-wide, not sandbox-local. Sandboxed code can use them to observe host application data across the vm2 boundary. This issue has been patched in version 3.11.4.
A vulnerability in the vm2 library's NodeVM component, prior to version 3.11.4, allows process-wide observability builtins to be accessed in a sandboxed environment. The affected builtins, which include diagnostics_channel, async_hooks, perf_hooks, and v8, are not properly blocked by the library's dangerous builtin denylist. This oversight enables sandboxed code to read host application data, such as HTTP request headers and performance metrics, creating a potential information leak.
Users can upgrade to vm2 version 3.11.4 or later, where this vulnerability has been patched. Instructions for updating can be found in the vm2 repository's release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/patriksimek/vm2/security/advisories/GHSA-9g8x-92q2-p28f | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/patriksimek/vm2/commit/e1c48fce05189f48e71efbd32af0754efa4066bb | [email protected] | Source CodeVendor |
| https://github.com/patriksimek/vm2/releases/tag/v3.11.4 | [email protected] | Release NotesVendor |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-9g8x-92q2-p28f | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-668 | Exposure of Resource to Wrong Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vm2 | <= 3.11.3 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 13, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |