Executive brief
vm2 is a popular library used to run untrusted code in a secure, isolated environment (sandbox) within Node.js applications. A vulnerability was discovered where the sandbox fails to block certain diagnostic and performance tools that monitor the entire host application. An attacker running code inside the sandbox could use these tools to steal sensitive information from the host, such as HTTP authorization headers, session tokens, and user data from other active requests.
Technical details
A vulnerability in vm2's NodeVM component arises because the 'require.builtin' denylist fails to include several process-wide observability modules: diagnostics_channel, async_hooks, perf_hooks, and v8. Because these modules operate at the process level rather than the sandbox level, sandboxed code can subscribe to host-level events. For example, an attacker can use 'diagnostics_channel' to intercept 'IncomingMessage' objects containing raw HTTP headers (Authorization, Cookies) from the host server, or use 'async_hooks' to access 'AsyncLocalStorage' data. This allows for significant information disclosure across the sandbox boundary. The issue is addressed in version 3.11.4 by adding these modules to the DANGEROUS_BUILTINS list.
Affected products
- patriksimek vm2 <= 3.11.3
Timeline
- 2026-05-18: patched: Fix committed and version 3.11.4 released.
- 2026-06-12: disclosed: CVE-2026-47141 published.