{"id":"EUVD-2026-36446","enisaUuid":"a8d9a8b9-bdf7-3bd0-8ab7-1b3b76f5b522","description":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.","datePublished":"Jun 12, 2026, 2:16:10 PM","dateUpdated":"Jun 13, 2026, 3:55:57 AM","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-rp36-8xq3-r6c4\nhttps://github.com/patriksimek/vm2/commit/a1ed47a98d1cc36cb48c0d566d55889688e0b59b\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.4\n","aliases":"CVE-2026-47140\nGHSA-rp36-8xq3-r6c4\n","assigner":"GitHub_M","epss":0.98,"enisaIdProduct":[{"id":"25c7aef9-ecfd-3084-b8a6-d805f0c69006","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.4"}],"enisaIdVendor":[{"id":"e5674d6d-d7f2-314f-8944-1bdd7b2eb806","vendor":{"name":"patriksimek"}}],"enisaIdVulnerability":[{"id":"42cfc5dc-e26d-382a-bf29-b00c386f5cf0","vulnerability":{"id":"CVE-2026-47140","description":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.","datePublished":"Jun 12, 2026, 2:16:10 PM","dateUpdated":"Jun 13, 2026, 3:55:57 AM","status":"PUBLISHED","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-rp36-8xq3-r6c4\nhttps://github.com/patriksimek/vm2/commit/a1ed47a98d1cc36cb48c0d566d55889688e0b59b\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.4\n","enisa_id":"EUVD-2026-36446\n","assigner":"GitHub_M","epss":0.98,"dataProcessed":"Nov 1, 2026, 7:19:05 AM","vulnerabilityProduct":[{"id":"740bc294-423d-3a64-a067-659537135f86","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.4"}],"vulnerabilityVendor":[{"id":"6c8d6d4e-9e19-397c-bccb-75f194575bf8","vendor":{"name":"patriksimek"}}]}},{"id":"ed88914f-a171-3f28-be3c-20c67fb077e2","vulnerability":{"id":"GHSA-rp36-8xq3-r6c4","description":"NodeVM builtin denylist bypass via process and inspector/promises allows host code execution","datePublished":"May 29, 2026, 5:59:23 PM","dateUpdated":"Jun 12, 2026, 8:56:50 PM","baseScore":0.0,"references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-rp36-8xq3-r6c4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47140\nhttps://github.com/patriksimek/vm2/commit/a1ed47a98d1cc36cb48c0d566d55889688e0b59b\nhttps://github.com/patriksimek/vm2\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.4\n","enisa_id":"EUVD-2026-36446\n","aliases":"GHSA-rp36-8xq3-r6c4\nCVE-2026-47140\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"580f37ed-915f-3169-aef0-0baebc8d0a0d","advisory":{"id":"RHSA-2026:33574","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.6 release.","summary":"Red Hat Developer Hub 1.9.6 has been released.","datePublished":"Jun 30, 2026, 3:00:33 PM","dateUpdated":"Oct 31, 2026, 6:06:26 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:33574\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33574.json\n","aliases":"CVE-2026-9277\nCVE-2026-9673\nCVE-2026-27145\nCVE-2026-33811\nCVE-2026-39820\nCVE-2026-42033\nCVE-2026-42035\nCVE-2026-42039\nCVE-2026-42041\nCVE-2026-42043\nCVE-2026-42044\nCVE-2026-42338\nCVE-2026-42499\nCVE-2026-44486\nCVE-2026-44487\nCVE-2026-44488\nCVE-2026-44492\nCVE-2026-44494\nCVE-2026-44495\nCVE-2026-44496\nCVE-2026-44724\nCVE-2026-45736\nCVE-2026-47131\nCVE-2026-47135\nCVE-2026-47137\nCVE-2026-47139\nCVE-2026-47140\nCVE-2026-47141\nCVE-2026-47208\nCVE-2026-47209\nCVE-2026-48779\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"03ade702-cbc9-3024-82bf-dc2a0a643224","product":{"name":"Red Hat Developer Hub 1.9","vendor":{"name":"Red Hat"}}},{"id":"3ad32e41-b743-33de-abd5-28532eb1db8f","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:219babfcc89ae903edf35022aae79ba1d1b326386978db8ff267e24e50f9a785_amd64","vendor":{"name":"Red Hat"}}},{"id":"ba26e3ee-b0ea-3abf-9c2c-c4679bafb270","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:044d2d72c21329826c144d9b55c381576a421188139de0fed693e74997665d2c_amd64","vendor":{"name":"Red Hat"}}},{"id":"e87b9f6c-6992-3b1a-9d17-64e2bf043a42","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:66fb23e8dbced7bb187928fb38562ae9e2649265d56f745044dd5e79b4209893_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"d6876af6-5bf6-3dbc-bb20-ef827dd20b0c","advisory":{"id":"RHSA-2026:36754","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.2 release.","summary":"Red Hat Developer Hub 1.10.2 has been released.","datePublished":"Jul 8, 2026, 1:07:12 PM","dateUpdated":"Oct 31, 2026, 3:41:14 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:36754\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36754.json\n","aliases":"CVE-2026-6322\nCVE-2026-6734\nCVE-2026-9277\nCVE-2026-9673\nCVE-2026-9697\nCVE-2026-12143\nCVE-2026-12151\nCVE-2026-24781\nCVE-2026-27136\nCVE-2026-39820\nCVE-2026-42338\nCVE-2026-42499\nCVE-2026-44486\nCVE-2026-44487\nCVE-2026-44488\nCVE-2026-44492\nCVE-2026-44494\nCVE-2026-44495\nCVE-2026-44496\nCVE-2026-45736\nCVE-2026-47131\nCVE-2026-47135\nCVE-2026-47137\nCVE-2026-47139\nCVE-2026-47140\nCVE-2026-47141\nCVE-2026-47208\nCVE-2026-47210\nCVE-2026-48779\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0f14fa1f-fa38-36ce-bf45-f89137f35d1b","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:d4208a03e389fe82e7da2d27c491251e6d43a0b473aa80d3e6a351c77582a92a_amd64","vendor":{"name":"Red Hat"}}},{"id":"5fac6ca8-8fe1-31d4-a002-db1289c2c19c","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:61883f5228095e3a3fd5b7daf60e29a5ffd053844f8661a2b5282a77c086dc02_amd64","vendor":{"name":"Red Hat"}}},{"id":"75062e24-95c7-30c4-99fa-d45cc08b8c8f","product":{"name":"registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:bea9305c453e377dfe6abf20076aec408efe2cbcf05f5a1c04c9b2d2f288bd65_amd64","vendor":{"name":"Red Hat"}}},{"id":"7e435575-3d3b-3b5e-8bc3-c3f04f8ca16f","product":{"name":"Red Hat Developer Hub 1.10","vendor":{"name":"Red Hat"}}},{"id":"96f302ed-b73f-381f-932a-b36797539266","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:0856143fa78dbbd74c1c068c75c265451698913608009f40600bb7c46928739b_amd64","vendor":{"name":"Red Hat"}}},{"id":"bf0c01af-6d82-3776-9fc4-6d8cfcfddb34","product":{"name":"registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:aacbef97f59305a91db44c3c92c34509027b3d2a4ece07716e6fe8b217dd5ee1_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"dcdcffca-a818-3cc5-8d6f-9cb933d69667","advisory":{"id":"RHSA-2026:50850","description":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update","summary":"Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.","datePublished":"Aug 5, 2026, 4:35:19 PM","dateUpdated":"Oct 31, 2026, 3:41:27 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:50850\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50850.json\n","aliases":"CVE-2026-9277\nCVE-2026-43997\nCVE-2026-43998\nCVE-2026-43999\nCVE-2026-44000\nCVE-2026-44001\nCVE-2026-44002\nCVE-2026-44003\nCVE-2026-44004\nCVE-2026-44005\nCVE-2026-44006\nCVE-2026-44007\nCVE-2026-44008\nCVE-2026-44009\nCVE-2026-45411\nCVE-2026-47131\nCVE-2026-47135\nCVE-2026-47137\nCVE-2026-47139\nCVE-2026-47140\nCVE-2026-47141\nCVE-2026-47209\nCVE-2026-48068\nCVE-2026-48801\nCVE-2026-59877\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"311ecff8-8324-3291-b7f2-d8b3178ab547","product":{"name":"registry.redhat.io/ansible-automation-platform/automation-portal@sha256:a85a548cb563a32be76c6e7e015fd57d340e068e321bf34b060d9eb901c33c4d_amd64","vendor":{"name":"Red Hat"}}},{"id":"31e60952-0a9a-3915-aadb-28544aea82d4","product":{"name":"Red Hat Ansible Automation Platform 2.1","vendor":{"name":"Red Hat"}}},{"id":"860f696f-a4de-3063-8cce-cf79cc54207b","product":{"name":"Self-service automation portal 2.1","vendor":{"name":"Red Hat"}}}]}}]}