vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.

Source published

12 Jun 2026 14:16:10 UTC

Source modified

13 Jun 2026 03:55:57 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.

Source published

Jun 12, 2026, 2:16:10 PM (timezone not stated)

Source modified

Jun 13, 2026, 3:55:57 AM (timezone not stated)

Observed here

7 Nov 2026 10:39:52 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.

Source published

12 Jun 2026 15:16:28 UTC

Source modified

26 Oct 2026 11:10:00 UTC

Observed here

27 Oct 2026 13:11:40 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

## Summary `NodeVM` blocks several dangerous Node.js builtins such as `module`, `worker_threads`, `cluster`, `vm`, `repl`, and `inspector`. However, the denylist misses `process` and `inspector/promises`. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. ## Details The dangerous builtin denylist is defined in `lib/builtin.js`. This list does not include: ```text process inspector/promises ``` Non-denied builtins are exposed to the sandbox through: ```js builtins.set(key, special ? special : vm => vm.readonly(hostRequire(key))); ``` Because of this, sandboxed code can bypass the expected restrictions in two ways: 1. `require('process').getBuiltinModule('child_process')` reloads `child_process`, even when `child_process` is excluded. 2. `require('inspector/promises')` exposes the Inspector protocol and can call `Runtime.evaluate` in the host process. ## PoC Tested on: ```text vm2: 3.11.2 Node.js: v25.9.0 ``` Run from the vm2 repository root: ```bash node poc/dangerous-builtin-denylist-rce.js ``` [dangerous-builtin-denylist-rce.js](https://github.com/user-attachments/files/27570113/dangerous-builtin-denylist-rce.js) The PoC first confirms the intended restrictions work: ```text require("inspector"): BLOCKED require("child_process"): BLOCKED ``` Then it bypasses them: ```text require("process").getBuiltinModule("child_process").execFileSync(...) ``` This spawns a host child process. It also confirms: ```text require("inspector/promises").Session().post("Runtime.evaluate", ...) ``` This evaluates JavaScript in the host process. <img width="858" height="766" alt="Screenshot 2026-05-10 at 11 53 33 AM" src="https://github.com/user-attachments/assets/7614aecb-5ffd-4c41-bfe8-e1fcb3b1bb59" /> ## Impact An attacker who can run untrusted JavaScript inside `NodeVM` with affected builtin settings can escape the sandbox and execute arbitrary code in the host process. This can lead to full compromise of the application process, including reading files, writing files, spawning processes, and accessing host environment secrets. (This is not reachable with the default NodeVM configuration where require is disabled or no affected builtins are allowed. It affects applications that allow process, inspector/promises, or the wildcard "*" in require.builtin.) ## Suggested fix Add `process` and `inspector/promises` to the dangerous builtin blocklist. Also consider blocking dangerous builtin families by prefix, for example blocking both: ```text inspector inspector/* ``` instead of only exact module names.

Source published

29 May 2026 17:59:23 UTC

Source modified

12 Jun 2026 21:15:15 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Publisher rating · CRITICAL