vm2 CVE-2026-47139

The host application must use vm2's NodeVM with a require.builtin configuration that enables the '*' wildcard combined with -name exclusions for network modules (the documented pattern from vm2's own docs: ['*', '-http', '-https', '-net', '-dgram', '-tls', '-dns', '-dns/promises', '-http2']); the attacker must be able to execute arbitrary JavaScript inside that sandbox. Limiting factors that bound real-world risk: (1) deployments that do NOT use the wildcard (instead enumerating an explicit allowlist of needed builtins) are not vulnerable; (2) deployments where NodeVM does not accept attacker-controlled code are not exploitable; (3) impact is bounded to network reachability from the host process - there is no host filesystem access or arbitrary code execution outside the sandbox. The S:C / C:H CVSS components reflect that the sandbox boundary is crossed but only for network capability, not full host compromise.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N (score 8.6) reflects the SSRF-style blast radius from a compromised sandbox: network reachable, low complexity, no privileges, no user interaction, and a scope change (sandbox boundary crossed) yielding high confidentiality impact. EPSS and CISA KEV status were not provided in the input, so widespread opportunistic exploitation cannot be claimed; the realistic threat model is targeted abuse against applications that knowingly run untrusted JavaScript through vm2 with the documented '*' + '-http'/-net pattern. Publicly available exploit code exists in the GHSA advisory, raising practical risk for any deployment matching that configuration. The signals are internally consistent - high CVSS is justified by the capability bypass enabling reach to cloud IMDS (e.g., 169.254.169.254) and internal HTTP services - but the conditional nature (requires the specific wildcard exclusion configuration) means this is not a default-config remote vulnerability in arbitrary vm2 users. Note: this is explicitly NOT host RCE; it is a network capability bypass, and treating it as RCE would overstate impact.

An application embeds vm2 NodeVM to run user-submitted JavaScript (e.g., a serverless function platform, a no-code automation builder, or a templating engine) and configures it with the documented builtin: ['*', '-http', '-https', '-net', ...] pattern to deny network access. A malicious user submits code that calls new (require('_http_client').ClientRequest)({host: '169.254.169.254', path: '/latest/meta-data/iam/security-credentials/'}) and exfiltrates cloud instance credentials, or scans 127.0.0.1 for internal admin panels and Redis/Elasticsearch instances. The published PoC in the GHSA advisory (internal-http-builtin-network-bypass.js) demonstrates both outbound requests via _http_client and listening sockets via _http_server.