CVE-2026-47140: vm2 Package Denylist Bypass Vulnerability Leading to Host Code Execution
Summary
CVE-2026-47140: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution. Affects vm2 versions < 3.11.4. Fixed in 3.11.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for executing untrusted JavaScript code. It allows developers to run code securely by blocking access to certain Node.js builtins that could be harmful. However, the package has a critical vulnerability that allows bypassing these restrictions, potentially leading to unauthorized code execution in the host environment.
Vulnerability Detail
The vulnerability arises from the incomplete denylist of dangerous Node.js builtins in the vm2 package. Specifically, the builtins 'process' and 'inspector/promises' are not blocked, allowing sandboxed code to access host execution primitives. This can lead to arbitrary code execution in the host process, enabling attackers to read and write files, spawn processes, and access sensitive environment variables. The issue is rooted in the way builtins are exposed to the sandbox, which fails to adequately restrict access to these critical modules.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.4
This is the first release that contains the fix.
npm install vm2@3.11.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'process' and 'inspector/promises' builtins in your sandboxed code until you can update to the patched version. Additionally, ensure that your application does not allow wildcard imports in require.builtin settings.
Conclusion
The vm2 package has a critical vulnerability that allows bypassing its builtin denylist, potentially leading to unauthorized code execution in the host environment. It is crucial to update to the patched version 3.11.4 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 10.0, indicating a critical level of severity.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
An attacker could execute arbitrary code in the host process, leading to full compromise of the application, including access to sensitive files and environment variables.
Yes, you can avoid using the 'process' and 'inspector/promises' builtins in your sandboxed code and ensure that wildcard imports are not allowed in require.builtin settings.
It is recommended to upgrade to vm2 version 3.11.4 or later to address this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
