{"id":"EUVD-2026-36449","enisaUuid":"1c0eee77-5027-3e69-a9d1-5d4c45d9d300","description":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they are allowed through require.builtin. The diagnostics_channel, async_hooks, and perf_hooks builtins are not blocked by the dangerous builtin denylist. These modules are process-wide, not sandbox-local. Sandboxed code can use them to observe host application data across the vm2 boundary. This issue has been patched in version 3.11.4.","datePublished":"Jun 12, 2026, 2:17:35 PM","dateUpdated":"Jun 13, 2026, 3:10:24 AM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-9g8x-92q2-p28f\nhttps://github.com/patriksimek/vm2/commit/e1c48fce05189f48e71efbd32af0754efa4066bb\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.4\n","aliases":"CVE-2026-47141\nGHSA-9g8x-92q2-p28f\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"080da862-5ac2-30c0-9761-3b75e781c2e1","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.4"}],"enisaIdVendor":[{"id":"2a5a72c6-37f8-3473-8a1e-3d9492c0cfcb","vendor":{"name":"patriksimek"}}],"enisaIdVulnerability":[{"id":"84c4ed13-4357-3eaf-9b0d-258d609f2dcc","vulnerability":{"id":"GHSA-9g8x-92q2-p28f","description":"NodeVM observability builtins leak host process and HTTP request data","datePublished":"May 29, 2026, 6:20:45 PM","dateUpdated":"Jun 12, 2026, 7:30:13 PM","baseScore":0.0,"references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-9g8x-92q2-p28f\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47141\nhttps://github.com/patriksimek/vm2/commit/e1c48fce05189f48e71efbd32af0754efa4066bb\nhttps://github.com/patriksimek/vm2\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.4\n","enisa_id":"EUVD-2026-36449\n","aliases":"GHSA-9g8x-92q2-p28f\nCVE-2026-47141\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:56:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"88d2a0c2-9aa3-31fe-a4f0-10832e71d7e0","vulnerability":{"id":"CVE-2026-47141","description":"vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they are allowed through require.builtin. The diagnostics_channel, async_hooks, and perf_hooks builtins are not blocked by the dangerous builtin denylist. These modules are process-wide, not sandbox-local. Sandboxed code can use them to observe host application data across the vm2 boundary. This issue has been patched in version 3.11.4.","datePublished":"Jun 12, 2026, 2:17:35 PM","dateUpdated":"Jun 13, 2026, 3:10:24 AM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/patriksimek/vm2/security/advisories/GHSA-9g8x-92q2-p28f\nhttps://github.com/patriksimek/vm2/commit/e1c48fce05189f48e71efbd32af0754efa4066bb\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.4\n","enisa_id":"EUVD-2026-36449\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Oct 28, 2026, 7:17:57 AM","vulnerabilityProduct":[{"id":"7a6e007c-9837-3d05-8895-36de052bca32","product":{"name":"vm2","vendor":{"name":"patriksimek"}},"product_version":"\u003c 3.11.4"}],"vulnerabilityVendor":[{"id":"82c2ffe1-ecbe-32de-8d34-108abe33d92a","vendor":{"name":"patriksimek"}}]}}],"enisaIdAdvisory":[{"id":"784d8705-99b3-3f33-a11a-f1f209eb203b","advisory":{"id":"RHSA-2026:50850","description":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update","summary":"Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.","datePublished":"Aug 5, 2026, 4:35:19 PM","dateUpdated":"Oct 15, 2026, 11:26:24 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:50850\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50850.json\n","aliases":"CVE-2026-9277\nCVE-2026-43997\nCVE-2026-43998\nCVE-2026-43999\nCVE-2026-44000\nCVE-2026-44001\nCVE-2026-44002\nCVE-2026-44003\nCVE-2026-44004\nCVE-2026-44005\nCVE-2026-44006\nCVE-2026-44007\nCVE-2026-44008\nCVE-2026-44009\nCVE-2026-45411\nCVE-2026-47131\nCVE-2026-47135\nCVE-2026-47137\nCVE-2026-47139\nCVE-2026-47140\nCVE-2026-47141\nCVE-2026-47209\nCVE-2026-48068\nCVE-2026-48801\nCVE-2026-59877\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"311ecff8-8324-3291-b7f2-d8b3178ab547","product":{"name":"registry.redhat.io/ansible-automation-platform/automation-portal@sha256:a85a548cb563a32be76c6e7e015fd57d340e068e321bf34b060d9eb901c33c4d_amd64","vendor":{"name":"Red Hat"}}},{"id":"31e60952-0a9a-3915-aadb-28544aea82d4","product":{"name":"Red Hat Ansible Automation Platform 2.1","vendor":{"name":"Red Hat"}}},{"id":"860f696f-a4de-3063-8cce-cf79cc54207b","product":{"name":"Self-service automation portal 2.1","vendor":{"name":"Red Hat"}}}]}},{"id":"7de77ab3-597b-3560-a65d-ccaa36601900","advisory":{"id":"RHSA-2026:33574","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.6 release.","summary":"Red Hat Developer Hub 1.9.6 has been released.","datePublished":"Jun 30, 2026, 3:00:33 PM","dateUpdated":"Oct 24, 2026, 6:36:36 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:33574\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33574.json\n","aliases":"CVE-2026-9277\nCVE-2026-9673\nCVE-2026-27145\nCVE-2026-33811\nCVE-2026-39820\nCVE-2026-42033\nCVE-2026-42035\nCVE-2026-42039\nCVE-2026-42041\nCVE-2026-42043\nCVE-2026-42044\nCVE-2026-42338\nCVE-2026-42499\nCVE-2026-44486\nCVE-2026-44487\nCVE-2026-44488\nCVE-2026-44492\nCVE-2026-44494\nCVE-2026-44495\nCVE-2026-44496\nCVE-2026-44724\nCVE-2026-45736\nCVE-2026-47131\nCVE-2026-47135\nCVE-2026-47137\nCVE-2026-47139\nCVE-2026-47140\nCVE-2026-47141\nCVE-2026-47208\nCVE-2026-47209\nCVE-2026-48779\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"03ade702-cbc9-3024-82bf-dc2a0a643224","product":{"name":"Red Hat Developer Hub 1.9","vendor":{"name":"Red Hat"}}},{"id":"3ad32e41-b743-33de-abd5-28532eb1db8f","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:219babfcc89ae903edf35022aae79ba1d1b326386978db8ff267e24e50f9a785_amd64","vendor":{"name":"Red Hat"}}},{"id":"ba26e3ee-b0ea-3abf-9c2c-c4679bafb270","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:044d2d72c21329826c144d9b55c381576a421188139de0fed693e74997665d2c_amd64","vendor":{"name":"Red Hat"}}},{"id":"e87b9f6c-6992-3b1a-9d17-64e2bf043a42","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:66fb23e8dbced7bb187928fb38562ae9e2649265d56f745044dd5e79b4209893_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"e1dc4334-cec4-3d36-8799-057c1bb9ffd2","advisory":{"id":"RHSA-2026:36754","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.2 release.","summary":"Red Hat Developer Hub 1.10.2 has been released.","datePublished":"Jul 8, 2026, 1:07:12 PM","dateUpdated":"Oct 24, 2026, 6:36:37 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:36754\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36754.json\n","aliases":"CVE-2026-6322\nCVE-2026-6734\nCVE-2026-9277\nCVE-2026-9673\nCVE-2026-9697\nCVE-2026-12143\nCVE-2026-12151\nCVE-2026-24781\nCVE-2026-27136\nCVE-2026-39820\nCVE-2026-42338\nCVE-2026-42499\nCVE-2026-44486\nCVE-2026-44487\nCVE-2026-44488\nCVE-2026-44492\nCVE-2026-44494\nCVE-2026-44495\nCVE-2026-44496\nCVE-2026-45736\nCVE-2026-47131\nCVE-2026-47135\nCVE-2026-47137\nCVE-2026-47139\nCVE-2026-47140\nCVE-2026-47141\nCVE-2026-47208\nCVE-2026-47210\nCVE-2026-48779\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0f14fa1f-fa38-36ce-bf45-f89137f35d1b","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:d4208a03e389fe82e7da2d27c491251e6d43a0b473aa80d3e6a351c77582a92a_amd64","vendor":{"name":"Red Hat"}}},{"id":"5fac6ca8-8fe1-31d4-a002-db1289c2c19c","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:61883f5228095e3a3fd5b7daf60e29a5ffd053844f8661a2b5282a77c086dc02_amd64","vendor":{"name":"Red Hat"}}},{"id":"75062e24-95c7-30c4-99fa-d45cc08b8c8f","product":{"name":"registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:bea9305c453e377dfe6abf20076aec408efe2cbcf05f5a1c04c9b2d2f288bd65_amd64","vendor":{"name":"Red Hat"}}},{"id":"7e435575-3d3b-3b5e-8bc3-c3f04f8ca16f","product":{"name":"Red Hat Developer Hub 1.10","vendor":{"name":"Red Hat"}}},{"id":"96f302ed-b73f-381f-932a-b36797539266","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:0856143fa78dbbd74c1c068c75c265451698913608009f40600bb7c46928739b_amd64","vendor":{"name":"Red Hat"}}},{"id":"bf0c01af-6d82-3776-9fc4-6d8cfcfddb34","product":{"name":"registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:aacbef97f59305a91db44c3c92c34509027b3d2a4ece07716e6fe8b217dd5ee1_amd64","vendor":{"name":"Red Hat"}}}]}}]}