CVE-2026-47141 vm2: NodeVM observability builtins leak host process and HTTP request data
Sandboxed code can leak host process and HTTP data via observability builtins if require.builtin is configured to allow them.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47141?
CVE-2026-47141 is a medium-severity vulnerability in patriksimek vm2, published on 12 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they are allowed through require.builtin. The diagnostics_channel, async_hooks, and perf_hooks builtins are not blocked by the dangerous builtin denylist. These modules are process-wide, not sandbox-local. Sandboxed code can use them to observe host application data across the vm2 boundary. This issue has been patched in version 3.11.4.
Weakness: CWE-668
Which versions are affected by CVE-2026-47141?
2 open source packages ship an affected version, including vm2.
| Package | Affected | Fixed in |
|---|---|---|
vm2 npm | All versions | 3.11.4 |
vm2 npm | All versions | 3.11.4 |
How do I fix CVE-2026-47141?
Upgrade vm2 to 3.11.4 or later.
Is CVE-2026-47141 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47141 exists.
Sources
Also known as ECHO-4102-701c-2063, GHSA-9g8x-92q2-p28f, MINI-6qmh-9p38-8276, ROOT-APP-NPM-CVE-2026-47141.