Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuard View on GitHub

GHSA-rp36-8xq3-r6c4

CriticalCVSS 10 / 10

Published May 29, 2026·Last modified May 29, 2026

Affected Components(1)

vm2

< 3.11.4

Description

Summary

NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector.

However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives.

This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process.

Details

The dangerous builtin denylist is defined in lib/builtin.js. This list does not include:

process
inspector/promises

Non-denied builtins are exposed to the sandbox through:

builtins.set(key, special ? special : vm => vm.readonly(hostRequire(key)));

Because of this, sandboxed code can bypass the expected restrictions in two ways:

require('process').getBuiltinModule('child_process') reloads child_process, even when child_process is excluded.
require('inspector/promises') exposes the Inspector protocol and can call Runtime.evaluate in the host process.

PoC

Tested on:

vm2: 3.11.2
Node.js: v25.9.0

Run from the vm2 repository root:

node poc/dangerous-builtin-denylist-rce.js

dangerous-builtin-denylist-rce.js

The PoC first confirms the intended restrictions work:

require("inspector"): BLOCKED
require("child_process"): BLOCKED

Then it bypasses them:

require("process").getBuiltinModule("child_process").execFileSync(...)

This spawns a host child process. It also confirms:

require("inspector/promises").Session().post("Runtime.evaluate", ...)

This evaluates JavaScript in the host process.

Impact

An attacker who can run untrusted JavaScript inside NodeVM with affected builtin settings can escape the sandbox and execute arbitrary code in the host process.

This can lead to full compromise of the application process, including reading files, writing files, spawning processes, and accessing host environment secrets.

(This is not reachable with the default NodeVM configuration where require is disabled or no affected builtins are allowed. It affects applications that allow process, inspector/promises, or the wildcard "*" in require.builtin.)

Suggested fix

Add process and inspector/promises to the dangerous builtin blocklist.

Also consider blocking dangerous builtin families by prefix, for example blocking both:

inspector
inspector/*

instead of only exact module names.

Risk Scores

Base Score

10.0

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The vulnerability can affect other systems as well, not just the initial system. There is a high impact on the confidentiality of the information. There is a high impact on the integrity of the data. There is a high impact on the availability of the system.

Threat Intelligence

9.1

Active exploitation in the wild has been confirmed. Immediate patching or mitigation is required.

EPSS

N/A

Probability that this vulnerability will be exploited in the wild within the next 30 days.

Exploit

Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Browse More

Critical severity

Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard