CVE-2026-47140: 
JavaScript 취약성 분석 및 완화

CVE-2026-47140 is a critical sandbox escape vulnerability in the vm2 Node.js sandboxing library, classified as a NodeVM builtin denylist bypass that allows host code execution. It affects vm2 versions up to and including 3.11.3 (npm package vm2 by patriksimek). The vulnerability was first published by the maintainer on May 18, 2026, added to the GitHub Advisory Database on May 29, 2026, and published by NVD on June 12, 2026. It carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incomplete denylist (CWE-693: Protection Mechanism Failure; CWE-184: Incomplete List of Disallowed Inputs) in lib/builtin.js, where the DANGEROUS_BUILTINS set omits process and the subpath module inspector/promises. Because non-denied builtins are exposed to the sandbox via builtins.set(key, special ? special : vm => vm.readonly(hostRequire(key))), sandboxed code can exploit two distinct bypass paths: (1) require('process').getBuiltinModule('child_process') — available in Node.js 22+ — reloads any core module regardless of the embedder's allow/deny configuration, and (2) require('inspector/promises').Session().post('Runtime.evaluate', ...) evaluates arbitrary JavaScript directly in the host process realm. The subpath form inspector/promises does not match the exact-string inspector denylist entry, allowing it to slip through. A PoC was included in the advisory and tested on vm2 3.11.2 with Node.js v25.9.0 (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker who can execute untrusted JavaScript inside a NodeVM instance to fully escape the sandbox and execute arbitrary code in the host Node.js process. This results in complete compromise of confidentiality (reading files, environment secrets), integrity (writing files, modifying host state), and availability (spawning or killing processes). The scope change (S:C in CVSS) reflects that the impact extends beyond the sandbox boundary to the host process and any resources it can access, enabling lateral movement within the host environment (GitHub Advisory).

1. Identify target: Locate a Node.js application using vm2 versions ≤ 3.11.3 with NodeVM configured to allow builtins via require.builtin: ['*'], ['*', '-child_process'], or any list that does not explicitly block process or inspector/promises.
2. Craft malicious sandbox payload (process path): Submit JavaScript code to the vm2 sandbox that calls require('process').getBuiltinModule('child_process') to obtain a reference to the host's child_process module, bypassing the sandbox's exclusion list.
3. Execute host command via child_process: Use the obtained reference to call cp.execFileSync('/bin/sh', ['-c', 'id']) or equivalent, spawning a child process in the host environment and achieving remote code execution.
4. Alternative path (inspector/promises): Submit sandbox code that calls const { Session } = require('inspector/promises'); const s = new Session(); s.connect(); s.post('Runtime.evaluate', { expression: '/* arbitrary host JS */' }); to evaluate arbitrary JavaScript directly in the host process realm.
5. Post-exploitation: With host process access, read sensitive files (e.g., environment variables, credentials), write backdoors, exfiltrate data, or pivot to other systems accessible from the host (GitHub Advisory, Patch Commit).

• Process: Unexpected child processes (e.g., /bin/sh, bash, curl, wget) spawned by the Node.js process running vm2; calls to execFileSync, execSync, or spawn originating from sandboxed code execution context.
• Logs: Application logs showing require('process') or require('inspector/promises') calls from within sandboxed code; Node.js inspector protocol Runtime.evaluate events in debug/trace logs.
• Network: Outbound connections from the Node.js server process to unexpected external hosts following sandbox code execution, potentially indicating reverse shell or data exfiltration activity.
• File System: New or modified files in the application directory or system paths created by the Node.js process user; unexpected cron jobs, SSH keys, or scripts written by the application process account.
• Environment: Access to process.env contents (e.g., API keys, database credentials) from sandboxed code, observable via audit logging if enabled (GitHub Advisory).

Upgrade vm2 to version 3.11.4, which adds process to the DANGEROUS_BUILTINS set and introduces a family-prefix matching function (isDangerousBuiltin(key)) that blocks all subpath variants (e.g., inspector/promises, node:process) at both the BUILTIN_MODULES wildcard expansion path and the addDefaultBuiltin explicit-allowlist path (vm2 Release, Patch Commit). As an interim workaround for applications that cannot immediately upgrade, avoid using builtin: ['*'] or any configuration that does not explicitly deny process and inspector/promises; instead, use a minimal allowlist of only the specific builtins required. Note that this vulnerability is not reachable in the default NodeVM configuration where require is disabled entirely.

Heise Online covered the vulnerability as part of a broader report on four critical (CVSS 10.0) security gaps closed in vm2, noting the significance of maximum-severity sandbox escapes in a widely used Node.js library (Heise Online). Security news outlet SecurityOnline.info also published coverage specifically highlighting the vm2 sandbox escape and its RCE implications (SecurityOnline). BeyondMachines summarized the issue as part of critical sandbox escape coverage (BeyondMachines). Red Hat opened a tracking bug and assigned medium priority for their product lines (Red Hat Bugzilla).