CVE-2026-47140: patriksimek vm2 sandbox escape via NodeVM builtin denylist bypass

CVE-2026-47140 · Severity: critical · CVSS 10 · Published 2026-06-12

vm2 is a popular library used to run untrusted JavaScript code in a secure, isolated 'sandbox' environment. A flaw in its security filters allows an attacker to bypass these restrictions by using specific internal Node.js components that were not properly blocked. If exploited, an attacker can break out of the sandbox to execute arbitrary commands on the host server, potentially leading to full system compromise and data theft.

Technologies: vm2 (npm). Vendors: npm.

Quick answers

Is CVE-2026-47140 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47140 being exploited in the wild.
How severe is CVE-2026-47140?
Critical severity, with a CVSS score of 10, published 12 June 2026.
Which products and versions are affected?
vm2 (npm) <= 3.11.3, SEMVER:introduced=0,fixed=3.11.4.
Is there a fix for CVE-2026-47140?
Yes. vm2 (npm): upgrade to 3.11.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47140 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47140?
Check whether you run vm2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vm2 (npm): upgrade to 3.11.4 or later
    npm install vm2@3.11.4

Technical details

A sandbox escape vulnerability exists in vm2's NodeVM due to an incomplete denylist of dangerous Node.js built-in modules. While the library attempts to block modules like 'child_process' and 'inspector', it fails to block 'process' and 'inspector/promises'. An attacker can use 'require(\'process\').getBuiltinModule(\'child_process\')' to reload restricted modules or use the inspector's 'Runtime.evaluate' to execute code in the host realm. This bypass is possible when the sandbox is configured to allow these specific modules or uses the '*' wildcard in the 'require.builtin' configuration. The issue is addressed in version 3.11.4 by implementing prefix-based matching for dangerous built-in families.

Affected products

  • patriksimek vm2 <= 3.11.3

Identifiers

  • CVE-2026-47140
  • GHSA-rp36-8xq3-r6c4

Timeline

  • 2026-05-17: patched: Fix committed to repository
  • 2026-05-18: advisory: GitHub Security Advisory published
  • 2026-06-12: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.