vm2 EUVD-2026-36449

Exploitation requires three concurrent conditions: (1) the host application must explicitly include at least one of diagnostics_channel, async_hooks, perf_hooks, or v8 in the NodeVM require.builtin allowlist - these are not permitted by default and must be intentionally granted; (2) the attacker must have the ability to execute arbitrary JavaScript within a NodeVM instance in the vulnerable process (a deliberate feature of applications running user-supplied code); and (3) the host process must be simultaneously handling sensitive data through the permitted channel - active HTTP requests with credential headers for diagnostics_channel exploitation, per-request identity data stored in AsyncLocalStorage for async_hooks exploitation, or sensitive labels in performance marks for perf_hooks exploitation. The default vm2 configuration without explicit builtin grants is not vulnerable. Authentication requirements cannot be assessed from CVSS data (no vector provided). Limiting factors are the non-default builtin permission requirement and the need for co-located sensitive data in the same Node.js process - deployments that isolate sandbox execution in separate processes or worker threads with no shared HTTP server are not affected.

No CVSS vector or score is provided for this CVE, precluding quantitative decomposition of attack vector, complexity, or privilege requirements - severity cannot be derived from CVSS data for this advisory. No EPSS score is available. This CVE is not in CISA KEV, indicating no confirmed widespread active exploitation at the time of analysis. However, a publicly available proof-of-concept exists (confirmed by GHSA-9g8x-92q2-p28f with a linked PoC file demonstrating live credential extraction), which meaningfully elevates real-world risk above the baseline for unconfirmed theoretical vulnerabilities. The exploitation condition - that the host must explicitly grant sandbox access to one of the affected builtins via require.builtin - limits the affected population to applications deliberately running untrusted JavaScript inside NodeVM with non-default builtin permissions. For those deployments (multi-tenant code execution platforms, serverless sandbox environments, or developer playgrounds), the real-world impact is high: cross-tenant credential theft is a realistic outcome. For deployments that do not permit these builtins or do not run untrusted code, risk is negligible. The information-disclosure-only impact (CWE-668) versus code-execution distinguishes this from higher-severity sandbox escapes, but token theft in a multi-tenant context can be operationally equivalent to full account compromise.

An attacker operating a tenant account on a multi-tenant Node.js platform that evaluates user-submitted JavaScript inside NodeVM - with diagnostics_channel included in the builtin allowlist - submits code that calls require('diagnostics_channel').subscribe('http.server.request.start', (msg) => exfiltrate(msg.request.headers)). When any concurrent HTTP request arrives at the host server in the same process, the attacker's sandboxed callback receives the full IncomingMessage object, including Authorization: Bearer HOST_HTTP_SECRET and x-session-token headers belonging to other users or the host application. A public proof-of-concept confirming this exact extraction path is referenced in GHSA-9g8x-92q2-p28f.