vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous
    Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist
    misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution
    primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the
    host process. This issue has been patched in version 3.11.4. (CVE-2026-47140)

ID	Name	Product	Family	Type	Severity
462159	Echo: vm2: security update to 3.11.4	Tenable Cloud Security	Echo Local Security Checks	Local	critical
462159	Echo: vm2: security update to 3.11.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
442463	SCA: security update for vm2 (GHSA-rp36-8xq3-r6c4)	Tenable Cloud Security	SCA Checks	Local	critical
442463	SCA: security update for vm2 (GHSA-rp36-8xq3-r6c4)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-47140

critical

Tenable Plugins

critical

critical

critical

critical