PT-2026-42732 · Npm · Vm2

Published 2026-05-22 · Updated 2026-06-12 · CVE-2026-47140

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.4

Description Sandbox escape flaws in NodeVM allow unauthenticated remote code execution on the host server. The issue occurs because the dangerous builtin denylist in lib/builtin.js misses process and inspector/promises. This allows sandboxed code to bypass restrictions and reach host-side execution primitives in two ways: using require('process').getBuiltinModule('child process') to reload child process even when excluded, or using require('inspector/promises') to expose the Inspector protocol and call Runtime.evaluate in the host process. This affects applications that allow process, inspector/promises, or the wildcard * in require.builtin.

Recommendations Update to version 3.11.4. As a temporary workaround, restrict the use of the process and inspector/promises modules or the wildcard * in the require.builtin configuration.

Exploit

Fix

RCE

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2026-47140

GHSA-RP36-8XQ3-R6C4

Affected Products

Vm2

References · 9

• 🔥 https://github.com/patriksimek/vm2/security/advisories/GHSA-rp36-8xq3-r6c4 · Exploit
• https://osv.dev/vulnerability/GHSA-rp36-8xq3-r6c4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47140 · Security Note
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/releases/tag/v3.11.4 · Note
• https://github.com/patriksimek/vm2/commit/a1ed47a98d1cc36cb48c0d566d55889688e0b59b · Note
• https://twitter.com/SecAlertsCo/status/2060446039878820121 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2065496508766564787 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2057664496789807293 · Twitter Post