vm2 CVE-2026-47140

Exploitation requires (1) the target application uses the NodeVM API of vm2 ≤ 3.11.3 to execute attacker-controlled JavaScript, and (2) the embedder's require.builtin configuration explicitly allows one of process, inspector/promises, or wildcard * - this is a non-default option, as the default NodeVM configuration disables require entirely. No user interaction, authentication, or privilege is required of the attacker beyond the ability to submit JavaScript to the sandbox endpoint. Not exploitable against: default NodeVM configurations, the lower-level VM API (only NodeVM uses require.builtin), or deployments that allowlist only safe builtins like events or buffer. Node.js version 22+ is required for the process.getBuiltinModule vector; the inspector/promises vector works on any Node version that exposes the subpath.

CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects the worst-case scenario where untrusted code reaches a misconfigured NodeVM over a network interface - full host compromise with no auth and changed scope. However, real-world risk is materially lower than the raw score suggests because exploitation requires the embedding application to (a) execute attacker-controlled JavaScript inside NodeVM AND (b) opt into a non-default require.builtin configuration that allows process, inspector/promises, or *. The vendor's own impact statement confirms default NodeVM configurations (require disabled, no affected builtins allowed) are not vulnerable. No KEV listing and no EPSS score were provided, but vm2 is a high-value target - multiple prior sandbox escapes have been weaponized rapidly, and publicly available PoC code lowers the barrier to opportunistic exploitation of vulnerable hosted-eval services. Treat as high priority for any product that exposes vm2 to external input, lower priority for internal-only or default-configured deployments.

An attacker submits JavaScript to an application that evaluates user code inside vm2's NodeVM (e.g., a hosted code playground, server-side template engine, or low-code automation platform) where the embedder has allowed process or wildcard builtins. The attacker's payload calls require('process').getBuiltinModule('child_process').execFileSync('/bin/sh', ['-c', '...']) - or alternatively require('inspector/promises') and posts Runtime.evaluate - to execute arbitrary commands in the host process, leading to file read/write, secret exfiltration from process.env, and full application compromise. Working PoC code is published in the advisory (poc/dangerous-builtin-denylist-rce.js).