CVE-2026-47141
CVE-2026-47141 · vm2: NodeVM observability builtins leak host process and HTTP request data
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they are allowed through require.builtin. The diagnostics_channel, async_hooks, and perf_hooks builtins are not blocked by the dangerous builtin denylist. These modules are process-wide, not sandbox-local. Sandboxed code can use them to observe host application data across the vm2 boundary. This issue has been patched in version 3.11.4.
CVSS 6.9 · Media · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node