CVE Explorer
CVE-2026-47141
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they are allowed through require.builtin. The diagnostics_channel, async_hooks, and perf_hooks builtins are not blocked by the dangerous builtin denylist. These modules are process-wide, not sandbox-local. Sandboxed code can use them to observe host application data across the vm2 boundary. This issue has been patched in version 3.11.4.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"vm2","vendor":"patriksimek","versions":[{"status":"affected","version":"< 3.11.4"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:6ace0a96d096378f980d9b46f4ebd380e22afcceaff29b1037f84dc766a205fc · sha256:692db85913678725… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:6ace0a96d096378f980d9b46f4ebd380e22afcceaff29b1037f84dc766a205fc · sha256:692db85913678725… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-668","description":"CWE-668: Exposure of Resource to Wrong Sphere","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:6ace0a96d096378f980d9b46f4ebd380e22afcceaff29b1037f84dc766a205fc · sha256:692db85913678725… · /containers/cna/problemTypes/0/descriptions/0
Source references
4 source assertions{"name":"https://github.com/patriksimek/vm2/commit/e1c48fce05189f48e71efbd32af0754efa4066bb","tags":["x_refsource_MISC"],"url":"https://github.com/patriksimek/vm2/commit/e1c48fce05189f48e71efbd32af0754efa4066bb"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:6ace0a96d096378f980d9b46f4ebd380e22afcceaff29b1037f84dc766a205fc · sha256:692db85913678725… · /containers/cna/references/1
{"name":"https://github.com/patriksimek/vm2/releases/tag/v3.11.4","tags":["x_refsource_MISC"],"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.4"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:6ace0a96d096378f980d9b46f4ebd380e22afcceaff29b1037f84dc766a205fc · sha256:692db85913678725… · /containers/cna/references/2
{"tags":["exploit"],"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-9g8x-92q2-p28f"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:6ace0a96d096378f980d9b46f4ebd380e22afcceaff29b1037f84dc766a205fc · sha256:692db85913678725… · /containers/adp/0/references/0
{"name":"https://github.com/patriksimek/vm2/security/advisories/GHSA-9g8x-92q2-p28f","tags":["x_refsource_CONFIRM"],"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-9g8x-92q2-p28f"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:6ace0a96d096378f980d9b46f4ebd380e22afcceaff29b1037f84dc766a205fc · sha256:692db85913678725… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.